# A Potential Second Shutoff from AT2018fyk: An updated Orbital Ephemeris of
the Surviving Star under the Repeating Partial Tidal Disruption Event Paradigm

Dheeraj Pasham MIT Kavli Institute for Astrophysics and Space Research
Cambridge, MA 02139, USA  E. R. Coughlin Department of Physics, Syracuse
University, Syracuse, NY 13210, USA  M. Guolo Department of Physics and
Astronomy, Johns Hopkins University, 3400 N. Charles St., Baltimore MD 21218,
USA  T. Wevers Space Telescope Science Institute, 3700 San Martin Drive,
Baltimore, MD 21218, USA  C. J. Nixon School of Physics and Astronomy, Sir
William Henry Bragg Building, Woodhouse Ln., University of Leeds, Leeds LS2
9JT, UK  Jason T. Hinkle NASA FINESST FI  Institute for Astronomy, University
of Hawai`i at Manoa, 2680 Woodlawn Dr., Honolulu, HI 96822  A. Bandopadhyay
Department of Physics, Syracuse University, Syracuse, NY 13210, USA

###### Abstract

The tidal disruption event (TDE) AT2018fyk showed a rapid dimming event 500
days after discovery, followed by a re-brightening roughly 700 days later. It
has been hypothesized that this behavior results from a repeating partial TDE
(rpTDE), such that prompt dimmings/shutoffs are coincident with the return of
the star to pericenter and rebrightenings generated by the renewed supply of
tidally stripped debris. This model predicted that the emission should shut
off again around August of 2023. We report AT2018fyk’s continued X-ray and UV
monitoring, which shows an X-ray (UV) drop in flux by a factor of 10 (5) over
a span of two months, starting 14 Aug 2023. This sudden change can be
interpreted as the second emission shutoff, which 1) strengthens the rpTDE
scenario for AT2018fyk, 2) allows us to constrain the orbital period to a more
precise value of 1306$\pm$47 days, and 3) establishes that X-ray and
UV/optical emission track the fallback rate onto this SMBH – an often-made
assumption that otherwise lacks observational verification – and therefore the
UV/optical lightcurve is powered predominantly by processes tied to X-rays.
The second cutoff implies that another rebrightening should happen between
May-Aug 2025, and if the star survived the second encounter, a third shutoff
is predicted to occur between Jan-July 2027. Finally, low-level accretion from
the less bound debris tail (which is completely unbound/does not contribute to
accretion in a non-repeating TDE) can result in a faint X-ray plateau that
could be detectable until the next rebrightening.

Galaxies: Optical – Galaxies: X-ray

##  1 Introduction

A tidal disruption event (TDE) occurs when a star approaches a supermassive
black hole (SMBH) and is either completely or partially destroyed (e.g., Rees,
1988; Gezari, 2021). TDE candidates were first discovered in the mid 1990s in
the X-rays using the ROSAT soft X-ray telescope (e.g., Bade et al. 1996; Grupe
et al. 1995; Donley et al. 2002) and more recently with optical sky surveys
like the ASASSN (Shappee et al., 2014), ATLAS (Tonry et al., 2018), Zwicky
Transient Facility (ZTF; Bellm 2014), and with eROSITA in the X-rays (Sazonov
et al., 2021). With an estimated observed rate of roughly one TDE every 104-5
years per galaxy (Yao et al., 2023; Sazonov et al., 2021), there is huge
excitement for Rubin observatory (first light in 2024) which is expected to
identify $>$100 events every year (van Velzen et al., 2011; Bricman & Gomboc,
2020).

A few dozens of TDEs are known so far and they have already transformed our
understanding of SMBHs and their immediate surroundings. For example, some
TDEs that were followed up extensively in the X-rays have shown powerful
outflows (e.g., see Wevers et al. 2024; Kosec et al. 2023; Ajay et al. 2024;
Kara et al. 2018). Some systems have highly relativistic jets (bulk Lorentz
factor $\sim$ a few tens) akin to blazars and have provided the best datasets
to test models of jet launching (e.g., see Pasham et al. 2023; Bloom et al.
2011; Brown et al. 2015; Pasham et al. 2015; Andreoni et al. 2022; Yao et al.
2024). In a few systems, radio synchrotron expanding at sub-relativistic
speeds has been found which can be either from internal shocks within a jet
(Pasham & van Velzen, 2018) or from external shocks with ambient medium(Cendes
et al., 2023).

In addition to these TDE subclasses, in the last few years a surprising new
sub-class has been uncovered: those that repeat on timescale of months to
years (Payne et al., 2021, 2022, 2023; Wevers et al., 2023; Liu et al., 2023b;
Evans et al., 2023; Guolo et al., 2024; Somalwar et al., 2023). These events
have been postulated to arise from a star on a bound orbit about an SMBH that
is partially disrupted during each pericenter passage. The TDE
AT2018fyk/ASASSN-18ul (redshift $z$=0.059, luminosity distance of 264.3 Mpc)
is thought to be one example of this new class, and was discovered by the
ASAS-SN optical survey in 2018, and follow-up monitoring with Swift, NICER,
XMM-Newton, and Chandra showed that it remained X-ray and UV bright for
roughly 500 days. Thereafter, it displayed a sudden and dramatic decrease in
the X-ray (by a factor of $>$6000) and the UV (by a factor of $\approx$15; see
Fig. 2 and Wevers et al. 2021). The source also exhibited apparent state
transitions similar to outbursting stellar-mass black hole binaries
(soft/UV/accretion disk dominated state $\Rightarrow$ hard/X-ray/corona-
dominated state $\Rightarrow$ quiescence; see Wevers et al. 2021).

The source was then found to be X-ray and UV-bright _again_ around day $\sim
1200$111All times in this paper are measured in observer’s frame with respect
to the optical discovery date of MJD 58369.2., with eROSITA non-detections
interspersed between the last non-detection at day 600 and the first new
detection at day 1200, showing that AT2018fyk suddenly “turned on” following a
$\sim 2$ year dark period – behavior that is otherwise unprecedented in
observed TDEs. The precipitous drop in luminosity and the rebrightening can be
explained by the rpTDE scenario222The presence of AGN in AT2018fyk was ruled
out based on detailed analyses of multi-wavelength data of the host galaxy,
see section 2.4 of Wevers et al. (2023): Wevers et al. (2023) argued that if
the return of the tidally disrupted debris to the SMBH is tightly coupled to
the accretion rate and the corresponding luminosity, which is a good
approximation for highly relativistic settings with small viscous delays, the
sudden cessation of accretion coincides with the return of the star to
pericenter, and the time between the sudden cutoff and the rebrightening
equates to the fallback time of the tidally stripped debris. With this model,
they deduced that the orbital period of the star is $\sim 1200$ days. They
predicted that, if the star was not destroyed during the second pericenter
passage, the system should display another dimming in August 2023, analogous
to the one observed in 2019.

Here, using continued X-ray monitoring with Swift, NICER, XMM-Newton and
Chandra, we report the finding of this second cutoff at 1830$\pm$29 days (14
Aug - 11 Oct 2023). Our data analysis is shown in section 2 while we discuss
the implications and provide specific predictions to further test the rpTDE
model in section 3.

##  2 Data and Analysis

We used the following cosmological parameters: $\Lambda$CDM cosmology with
parameters H0 = 67.4 km s-1 Mpc-1, $\Omega_{\rm m}$ = 0.315 and
$\Omega_{\rm\Lambda}$ = 1 - $\Omega_{\rm m}$ = 0.685 (Planck Collaboration et
al., 2020).

###  2.1 Swift X-Ray Data

Swift (Gehrels et al., 2004) observed AT2018fyk on 210 occasions as of 5 Jan
2024. Out of these, 5 were corrupted or did not have Photon Counting (PC) data
and were excluded. Observations up to MJD 59809, i.e., 178 of these
observations, were reported in Wevers et al. (2023). Here we present
additional monitoring data since 18 August 2022. For consistency, we reduce
the entire Swift archival data of AT2018fyk here.

We started our analysis by downloading the data from HEASARC public archive
(https://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/w3browse.pl) and reduced the
X-Ray Telescope (XRT; Burrows et al. 2005) observations on a per ObsID basis
using the HEASoft tool xrtpipeline. Then we extracted source and background
count rates in the 0.3-10.0 keV band using the ftool xrtlccorr. We used a
circular aperture of radius 47′′ for source and an annulus of inner and outer
radii of 70′′ and 235′′, respectively. These values were chosen to ensure
there are no contaminating sources within the chosen boundaries. From these,
we obtained a net (background-subtracted) rate for each ObsID.

AT2018fyk was especially faint with net rates close to zero in the most recent
observing campaign since MJD 60000 (approved Swift cycle 19 program 1922148;
PI: Pasham). Therefore, we carefully analyzed them by stacking them into 4
datasets with the following time boundaries: MJD 60030-60070 (L1), MJD
60070-60140 (L2), MJD 60140-60200 (L3), and MJD 60200-60310 (L4). The source
was detected in two of these four stacked datasets. The net 0.3-10.0 keV count
rate/3$\sigma$ upper limit for L1, L2, L3 and L4 epochs were
(1.5$\pm$0.6)$\times$10-3 cps, $<$4.3$\times$10-3 cps,
(2.6$\pm$0.7)$\times$10-3 cps, and $<$2$\times$10-3 cps, respectively. We also
visually inspected the exposure-corrected 0.3-10.0 keV image for epoch L3 in
which a point source is evident (see the middle panel of Fig. 1). Assuming a
spectrum similar to the one implied by an XMM-Newton observation taken around
that time, the flux conversion factor is 3.1$\times$10-11 erg s-1 cm-2/counts
sec-1.

###  2.2 Swift UV Data

UV observations were taken with Swift/UVOT contemporaneously with the XRT
observations. We used the uvotsource package to measure the UV photometry,
using an aperture of 5″. We subtracted the host galaxy contribution by
modeling archival photometry data with stellar population synthesis using
Prospector (Johnson et al., 2021), following the procedure described in Wevers
et al. (2021) and tabulated in their table 2. We apply Galactic extinction
correction to all bands using $E(B-V)$ value of 0.011 from Schlafly &
Finkbeiner (2011).

###  2.3 XMM-Newton

XMM-Newton observed AT2018fyk on 8 occasions (ObsIDs: 0831790201, 0853980201,
0854591401, 0911790701, 0911790601, 0911791501, 0911791401 and 0921510101).
Two observations (0911790701 and 0911791501) did not have any science data and
the rest, except for the latest one (ObsID: 0921510101), have been published
elsewhere (Wevers et al., 2019, 2021, 2023). This latest dataset was part of
an approved XMM-Newton cycle 22 Guest Observer Target Of Opportunity (GO ToO
program 92151; PI: Pasham) to capture the second X-ray shutoff of AT2018fyk.
While the main focus in this work will be on this latest dataset we also
reduce all the others here for uniformity.

We started XMM-Newton data analysis by downloading the data from the HEASARC
public archive (https://heasarc.gsfc.nasa.gov/cgi-bin/W3Browse/w3browse.pl).
Then we ran the epproc tool of XMMSAS software to reduce the European Photon
Imaging Camera (EPIC)’s pn detector. We did not use MOS data in this work.
First, we visually inspected the background in all the six ObsIDs following
the steps outlined in the data analysis thread:
https://www.cosmos.esa.int/web/xmm-newton/sas-thread-epic-filterbackground-in-
python. All observations were affected by background flares to some extent and
we removed those epochs to obtain a set of Good Time Intervals (GTIs) per
ObsID. Source events were extracted from a circular aperture with a radius of
30′′ while background events were extracted from a nearby circular aperture
free of any point sources with a radius of 50′′. The source is clearly
detected in all but 0854591401 (XMM3 as per Wevers et al. 2023). Consequently,
five spectra were extracted following the standard procedure outlined here:
https://www.cosmos.esa.int/web/xmm-newton/sas-thread-pn-spectrum. The spectra
were grouped using the specgroup task of XMM-Newton software (XMMSAS) to have
minimum of 1 count per spectral bin. Cash statistic was used for spectral
modeling in XSPEC (Arnaud, 1996). For each spectrum, we only used the bandpass
where the source is above the background (see Table 1).

The most recent dataset is consistent with a simple powerlaw modified by
MilkyWay absorption of 1.2$\times$1020 cm-2 (C-stat/degrees of freedom (dof)
of 110/114). Additional absorption at the host redshift is not required by the
data in any of the five spectra. The best-fit powerlaw index in the most
recent dataset is 1.96${}^{+0.86}_{-0.88}$ (see Table 1 for details on flux
and luminosity). The spectrum did not have enough signal-to-noise to test more
complicated spectral models.

Figure 1:  Left: XMM-Newton/EPIC-pn image of AT2018fyk’s field of view on MJD
60102.76 (XMM ObsID 0921510101). The circle centered on AT2018fyk has a radius
of 30′′ while the arrows pointing North and East are each 30′′ in length.
Middle: Stacked Swift/XRT image of AT2018fyk using data taken between MJDs
60140 and 60200, i.e., the data point around day 1800 between XMM-Newton
(pentagon) and Chandra detections (square) in Fig. 2 The statistical
significance of the detection is 3.7$\sigma$. The circle has a radius of 47′′
while the directional arrows are 90′′ each. Right: Stacked Chandra/ACIS X-ray
image using data from ObsIDs 28294 and 28972. The circle centered on AT2018fyk
has a 4′′ radius while the directional arrows are 5′′ each.

###  2.4 Chandra

Chandra ’s Advanced CCD Imaging Spectrometer (ACIS) observed AT2018fyk on
three occasions: MJD 59029.22 (29 June 2020), MJD 60227.71 (10 October 2023;
ObsID: 28294) and MJD 60228.58 (11 October 2023; ObsID: 28972). All these were
carried out in the ACIS-S array mode and we use the nominal bandpass of
0.5-7.0 keV throughout. The first observation was published in Wevers et al.
(2021) while the most recent two datasets were observed as part of an approved
Chandra Cycle 25 guest observer program to catch the source during the second
shutoff phase predicted by Wevers et al. (2023) (PI: Pasham; GO proposal
number 25700383). For consistency, we reduce all the three datasets here.

We started our data analysis by reducing the data with the chandra_repro tool
of CIAO 4.16 software using the latest CALDB 4.11.0. First, we extracted
exposure-corrected images in the 0.5-7.0 keV bandpass using the fluximage task
of CIAO and see an excess at the position of AT2018fyk in both of the most
recent observations (IDs: 28294 and 28972). Next, we extracted the X-ray
spectra and relevant response files for each of the two recent observations
separately using specextract tool of CIAO. These spectra were grouped to have
a minimum of 1 spectral count per bin using the optmin flag of the HEASoft
ftool ftgrouppha. We modeled them together in XSPEC (Arnaud, 1996) with a
powerlaw model modified by MilkyWay neutral absorption column of
1.2$\times$1020 cm-2 (tbabs*zashift*pow). With only 25 net (background-
corrected) counts the spectral index is poorly constrained. Therefore, we
fixed it at the best-fit value from the XMM-Newton data of 1.96. This yields a
best-fit C-statistic/dof of 38.5/56 and an observed 0.3-10.0 keV flux
(luminosity) of (9.0${}^{+1.0}_{-2.0}$)$\times$10-15 erg s-1 cm-2
(7.0${}^{+2.0}_{-1.0}$$\times$1040 erg s-1). This represents a factor of $>$7
decrease in flux since the latest XMM-Newton observation taken roughly 4
months earlier.

####  2.4.1 Chandra astrometry

We also combined the two observations to estimate an accurate position by
following the steps outlined in
https://cxc.cfa.harvard.edu/ciao/threads/fluxes_multiobi/. We computed the
offsets between the two datasets to be 0.18 pixels and 0.42 pixels in the X
and Y directions, respectively. To improve this we performed astrometric
correction to obsID 28972 to match with that of 28294 which has about 60%
higher exposure time (33 ks vs 20 ks). Following the steps outlined in the
above Chandra data analysis thread we reduced the offsets to 0.15 pixels and
0.06 pixels, respectively. An X-ray (0.5-7.0 keV) image from combining obsIDs
28294 and 28972 is shown in the right panel of Fig. 1. The source region
defined as a circular aperture of 4′′ in radius has 25 net counts. Running
wavdetect on this combined images yields a best-fit X-ray position of
(22:50:16.17,-44:51:53.00) with an uncertainty of 0.12′′ in each direction.
This is consistent with the best-fit Gaia position reported in Wevers et al.
(2019) based on the optical emission during the first outburst in 2018.

###  2.5 Hubble Space Telescope (HST)

The UV measurement from Hubble Space Telescope’s F275W filter with an
effective wavelength of 2750 Å was taken from Wen et al. (2024).

Figure 2:  Top: AT2018fyk’s observed 0.3-10.0 keV X-ray luminosity evolution
over the past $\sim$2000 days. The x-axis is in observer’s frame. Most recent
Chandra and Swift data shows a drop of $>$10 from 7$\times$1042 to
7$\times$1041 over two months. A similar change is also evident in the UV
light curve (bottom panel). Inverted triangles represent 3$\sigma$ upper
limits. This sudden change can be interpreted as a shutoff which allows us to
refine the orbital period of the star that is repeatedly disrupted to be
1306$\pm$47 days. The two shutoff epochs are highlighted with red/vertical
bands. The entire X-ray and UV photometry is available at
https://doi.org/10.5281/zenodo.10913475.

###  2.6 Shutoff and rebrightening times

The first X-ray and UV shutoffs happened between days 488 and 561 while the
second sharp decline occurred sometime during days 1801 and 1859 (see Fig. 2).
These values correspond to the observation dates. Per the model of Wevers et
al. (2023), the orbital period of the surviving star is the time between
shutoffs, which based on the above values is 1306 $\pm$ 47 days333Note that
Wevers et al. (2023) estimated the orbital period of the star by assuming that
the fallback time between the first and second encounters was the same, and
while this is likely a fairly good approximation, observing the successive
shutoffs is more direct. See Section 3 for additional discussion.. The
uncertainty is derived from adding the range in cutoff times in quadrature.
Using this we can formulate a crude ephemeris to predict the nth shutoff to
be:

$t_{\rm shutoff}^{n}(MJD)=(58893.5\pm 29)+(n-1)(1306\pm 47)$

This equation implies that the next (third) shutoff should occur sometime
between 2 Jan 2027 and 17 July 2027, assuming that the star survived its
second encounter. Alternatively, if the star was completely destroyed during
the second encounter, then there would be no third cutoff and the luminosity
would continue to smoothly decline.444We note that this possibility may
provide a unique opportunity to explore the differences in emission produced
by fallback from partial and complete disruption events in the same system,
i.e., comprising the same black hole mass and spin and stellar orbit.

The fallback time after the second pericenter passage of the star is the time
between the first shutoff and the second rebrightening (between 1164 and 1216
days). The fallback time will differ from one encounter to the next because
mass is stripped from the progenitor and the star is imparted net rotation
(Bandopadhyay et al., 2024a), and hence accurately predicting the next rise is
not as straightforward as predicting the orbital period. However, if we assume
a similar fallback time, then the next rise in flux should happen around
2495$\pm$54 days, which corresponds to an MJD 60864$\pm$54 (15 May – 31 Aug
2025).

The latest Chandra data point (green square in Fig. 2) is two orders of
magnitude below the peak of the second outburst and an order of magnitude
below a previous XRT detection roughly two months earlier. However, it is
possible that the latest Chandra data and the corresponding UV upper limits
may be due to anomalous source variability. For this reason, we refer to this
as a potential shutoff. This can be confirmed with further deep X-ray and UV
observations between now and the predicted next rebrightening in 2025.

##  3 Discussion and conclusions

The rpTDE model proposes that a star is on a highly eccentric ($0.99\lesssim
e<1$) orbit about an SMBH, with the short orbital period and high eccentricity
provided by the Hills mechanism (Cufari et al., 2022; Wevers et al., 2023).
Since the fallback time inferred from the observations is $\sim$ 600-700 days,
the SMBH powering the emission from AT2018fyk must be large and the disruption
must be partial, as both of these effects increase the return time of the
debris above the $\sim(30\pm
5)\times\left(M_{\bullet}/10^{6}M_{\odot}\right)^{1/2}$ days that is
characteristic of complete disruptions, with $M_{\bullet}$ the SMBH mass
(Coughlin & Nixon, 2022; Bandopadhyay et al., 2024b).

When the SMBH mass is large (as is inferred to be the case for AT2018fyk;
107.7±0.4; see Wevers et al. 2023), the accretion rate should be strongly
coupled to the fallback rate of debris, because the pericenter distance is
highly relativistic and the accretion timescale is short relative to the
fallback time. This model then predicts that the accretion rate should shut
off when the surviving core returns to the (partial) tidal disruption radius
(Wevers et al. 2023; see also Liu et al. 2023a), the reason being that the
Hill sphere that separates material bound to the black hole and bound to the
star grows with time approximately as $\propto t^{2/3}$, where $t$ is time
since pericenter (Coughlin & Nixon, 2019). Therefore, when the surviving core
returns to pericenter, there is a sudden drop in the mass supply to the SMBH
and the luminosity plummets. The simultaneous plummeting of the optical/UV
emission alongside the X-ray is also consistent with the interpretation that
the optical/UV emission is tied to X-ray emission555This seems inconsistent
with the interpretation that the optical/UV is sourced from a large-scale
outflow that is causally disconnected from the X-ray emission (e.g., Price et
al. 2024). that originates from the innermost few gravitational radii, which
in this case may be physically produced by circularization shocks, accretion,
or both (the former may also give rise to the nonthermal electrons powering
the corona; cf. Sironi & Tran 2024).

The time between successive cutoffs in emission should therefore closely track
the orbital period of the stellar core. Because the orbital period is related
to the orbital energy and the orbital energy can at most be reduced by the
binding energy of the star, there is effectively no change in this recurrence
time on a per-orbit basis (Cufari et al., 2023; Bandopadhyay et al.,
2024a).666This holds for orbits generated by the Hills disruption of a tight
binary, where by tight we mean that the binding energy of the binary is
comparable to the binding energy of the captured star (which was one of the
members of the original binary). In this case the binding energy of the
captured star’s orbit is larger than that of the star itself by a factor of
$(M_{\bullet}/M_{\star})^{1/3}$ (e.g. Cufari et al., 2022). On the other hand,
for a standard TDE in which the binding energy of the star’s orbit is $\sim
0$, the change in the energy of the core during core reformation (e.g. Nixon
et al., 2021; Nixon & Coughlin, 2022) or due to a positive-energy kick (e.g.
Manukian et al., 2013; Gafton et al., 2015) can give rise to substantial
differences in the orbital period between successive partial disruptions. On
the other hand, the time between the cutoff and the next rebrightening equals
the fallback time of the most-bound debris that is related to the properties
of the star and its rotation rate, and the latter changes as a consequence of
the tidal interaction with the SMBH (since the imparted spin is prograde with
respect to the orbital angular momentum, the result is a decrease in the
return time of the debris; Golightly et al. 2019). Wevers et al. (2023)
estimated the orbital time of the star – and thereby predicted the time of the
second cutoff – by assuming that the fallback time was unchanged between the
first and second encounter: since the first cutoff occurred at $\sim$ 500 days
(since first detection) and the second brightening at $\sim$ 1200 days, the
fallback time (for the second encounter) was $\sim 700$ days and the first
pericenter passage must have occurred $\sim 700$ days prior to the first
detection _if the fallback times were identical on the first and second
encounter_ , making the orbital period of the star $\sim 1200$ days. If we now
associate the green datapoint at day $\sim 1850$ as the second _observed_
cutoff (note that this date also coincides with the observed cutoff in the
optical/UV, which is qualitatively in agreement with the behavior observed
during the first cutoff), then this suggests that the true (i.e., from the
observed successive cutoffs) orbital period of the star is between 1250-1350
days. This finding suggests that the fallback time on the second encounter was
shorter than that of the first by $\sim 50-150$ days, which is different at
the $\sim 10-20\%$ level. This is consistent with the theoretical results of
Golightly et al. (2019) if the imparted spin to the star was a significant
fraction of breakup (which is expected, given the importance of nonlinear
interactions when the tidal field of the SMBH is comparable to the self-
gravitational field of the star). If the star is spun up to a closer fraction
of the angular velocity at pericenter on its third encounter, we would expect
a reduced fallback time in going from the second shutoff to the start of the
third electromagnetic outburst, and the observation (or lack thereof) of this
feature would provide another test of this model.

A noticeable difference between the first and second outburst in AT2018fyk’s
lightcurve is the peak luminosity, which is reduced by a factor of $\sim 5-10$
from the first to second brightening. Under the rpTDE paradigm, this
difference could be due to one or more potential factors. If, for example, the
partially disrupted star was highly centrally concentrated – which would arise
naturally as a consequence of stellar evolution if the star is sufficiently
massive – then it seems plausible that the stripping of the envelope on the
first encounter could leave the high-density core relatively unperturbed, the
result being that the tidal radius of the surviving core is smaller. Since the
pericenter distance of the star is effectively unaltered owing to the
conservation of angular momentum, the $\beta$ ($=r_{\rm t}/r_{\rm p}$, with
$r_{\rm p}$ the pericenter distance and $r_{\rm t}$ the tidal radius) of the
encounter is reduced, resulting in less mass stripped on subsequent tidal
interactions and a reduction in the accretion rate (and the luminosity).

Bandopadhyay et al. (2024a) recently showed (and in agreement with the
suggestion by Liu et al. 2023a) that more massive and evolved stars
(specifically a $1.3M_{\odot}$ and a $3M_{\odot}$ star near the end of the
main sequence) that require very deep encounters to be completely destroyed –
and are thus statistically significantly more likely to be partially disrupted
– are capable of producing flares of nearly equal amplitude after many
successive outbursts, despite the fact that the amount of mass stripped from
the star declines slightly per pericenter passage (see their Figures 7, 8, and
11). Contrarily, a sun-like star closer to the zero-age main sequence, which
is significantly less centrally concentrated than an evolved star of the same
mass, was shown by the same authors to suffer increasing degrees of mass loss
per encounter, even when the pericenter distance of the encounter was a factor
of $\sim 3$ larger than that required to completely destroy the star on the
first encounter (see their Figure 13; see also Liu et al. 2024, who came to
similar conclusions regarding the fate of a solar-like star after multiple
encounters). Similarly, since a star of significantly lower mass ($\lesssim
0.1\times fewM_{\odot}$) cannot evolve substantially over the age of the
Universe and is effectively a $5/3$-polytrope, the range in radii where such a
low-mass star could be repeatedly stripped of a small amount of mass
($\beta\equiv r_{\rm t}/r_{\rm p}\simeq 0.5-0.6$, where $r_{\rm p}$ is the
pericenter distance of the star and $r_{\rm
t}=R_{\star}\left(M_{\bullet}/M_{\star}\right)^{1/3}$ is the tidal disruption
radius with $R_{\star}$ and $M_{\star}$ the stellar radius and mass;
Guillochon & Ramirez-Ruiz 2013; Mainetti et al. 2017; Miles et al. 2020;
Cufari et al. 2023) per encounter is very fine tuned, and the detection of a
second cutoff here suggests that the star must have survived at least two
encounters. Thus, and despite their relative rarity, a more massive star could
be the most promising candidate for producing the repeated flares in 2018fyk.
A more massive star would also permit wider initial binaries (while yielding
the same period of the captured star), a less relativistic pericenter
distance, and a longer fallback time of the tidally stripped debris compared
to the more extreme values required for a solar-like star to fit the
observations (see the discussion in Section 4 of Wevers et al. 2023).

Additionally, if the Hills mechanism is responsible for placing the star on
its tightly bound orbit about the SMBH, then there will be a difference
between the pericenter distance of the partially disrupted (and captured) star
during its initial hydrodynamical interaction between the SMBH and the
(ultimately ejected) companion star and subsequent encounters. If it is such
that the $\sim$ conserved pericenter distance of the captured star is larger
than that of the initial interaction, then less mass will be stripped on the
second encounter, resulting in a relatively smaller accretion luminosity on
the second outburst. Depending on how centrally concentrated the star is and
the $\beta$ of the encounter, subsequent outbursts could be progressively more
or less luminous with time. As also discussed in Bandopadhyay et al. (2024a),
the tight binary required to populate the star on its $\sim 1300$-day orbit
implies that the rotation rate of the captured star is a significant fraction
of the angular velocity at pericenter, which will also have a significant
impact on the magnitude of successive flares and the return time of the debris
(Golightly et al., 2019)).

From the rpTDE model, the orbital time of the star is $\sim 1200-1400$ days
and the fallback time is $\sim 600-800$ days (note that such long fallback
times require the event to be a partial disruption; Bandopadhyay et al.
2024a), which predicts that the freshly stripped debris generated on the third
encounter (i.e., the second dimming around the green point in Figure 2) should
produce a third brightening at day $\sim 2500$ post-initial-detection (though,
as noted above, the additional imparted spin to the star near pericenter could
yield a time closer to day $\sim 2400$). This third brightening should then
occur in early-2025, which is consistent with the predictions in Wevers et al.
(2023), and the future detection or non-detection thereof would provide strong
evidence in support of or against this model.

An alternative interpretation, as proposed by Wen et al. (2024), is that the
reduction in the luminosity of AT2018fyk is due to the presence of a companion
black hole, and that the disrupting black hole was of very low mass compared
to the primary. In such extreme-mass-ratio systems, there could be a dramatic
dimming when the tidally stripped debris nears the Hill sphere of the
secondary (disrupting) black hole after the first encounter, provided that the
orientation of the binary is favorable (Coughlin & Armitage, 2018). Wen et al.
(2024) then proposed that the second outburst arose from accretion onto the
primary. However, when the secondary is the disrupting SMBH and the stream is
relatively confined to the orbital plane of the binary – which must be the
case if accretion onto the primary is responsible for the second outburst –
the distribution of the debris is highly stochastic (see, e.g., Figures 1 & 2
of Coughlin & Armitage 2018, or Figures 9 & 10 of Coughlin et al. 2017), and
it is difficult to see why this scenario would produce repeated and dramatic
dimmings on this same timescale.

Finally, the partial TDE results in the production of two tails of stellar
debris. In typical TDEs where the star is on a parabolic orbit, the second
tail is ejected from the system and yields no observational signature (with
the possible exception of radio emission in the presence of circumnuclear gas;
e.g., Guillochon et al. 2016; Yalinewich et al. 2019). However, and as noted
in Wevers et al. (2023), the bound nature of the stellar orbit in this case
implies that the second tail may be “less bound” rather than unbound, with the
specific energy of the second tail a function of the specific energy of the
core and the energy spread imparted by the tidal field. It could be that
deeper X-ray monitoring of AT2018fyk during the second (current) shutoff phase
would reveal the presence of low-level emission from this second tail, and
since the energy of the core is constrained from the observed orbital period,
this emission would yield additional information about the properties of the
star and the SMBH. rpTDEs are thus unique in their ability to more directly
constrain stellar and SMBH properties in distant galaxies.

D.R.P was supported by NASA XMM-Newton guest observed program, proposal number
92395 (award number 035212-00001), and Chandra program 25700383 (award number
035385-00001). E.R.C. and A.B. acknowledge support from NASA through the _Neil
Gehrels Swift_ Guest Investigator Program, proposal number 1922148. E.R.C.
acknowledges additional support from the National Science Foundation through
grant AST-2006684, and from NASA through the Astrophysics Theory Program,
grant 80NSSC24K0897. C.J.N. acknowledges support from the Science and
Technology Facilities Council (grant No. ST/Y000544/1) and from the Leverhulme
Trust (grant No. RPG-2021-380). This research was supported in part by grant
NSF PHY-2309135 to the Kavli Institute for Theoretical Physics (KITP).

Table 1: Summary of XMM-Newton and Chandra X-ray energy spectral modeling. †The net exposure after filtering for background flares. Total exposure before correcting for flares is shown in brackets. ††Net count rate (background-corrected) in the bandpass where the source is above the background. †††Bandpass where the source and the background spectrum crossover. This is different for each spectrum and modeling was performed in this custom band depending on the observation. We repeated the entire analysis in a fixed 0.3-1.5 keV band and the resulting values were consistent with those reported in this table. ∗Normalization of the best-fit disk black body. ∗∗Powerlaw index. §Normalization value of the powerlaw model component. §§Observed flux and luminosities in the 0.3-10.0 keV band. tbabs*zashift(diskbb+pow) was used for modeling. In cases where kT is indicated by “…” a disk component was not necessary. §§§Both the Chandra spectra were fit together, hence the same spectral parameters. The powerlaw index was fixed at the best-fit XMM-Newton value from ObsID 0921510101.  Telescope | ObsID | MJD | Exposure† | Count rate†† | Bandpass††† | kT | NkT∗ |  $\Gamma$∗∗ | N${}_{\Gamma}^{\S}$ | Flux§§$\times$10-13 | Luminosity§§ | C-stat/dof
---|---|---|---|---|---|---|---|---|---|---|---|---
|  |  | (ks) | (counts/sec) | (keV) | (keV) |  |  | ($\times$10-5) | (erg s-1 cm-2) | (1042 erg s-1) |
XMM | 0831790201 | 58461.72 | 17.0 (33) | 0.403$\pm$0.004 | 0.3-2.5 | 0.123${}^{+0.005}_{-0.004}$ | 493${}^{+100}_{-164}$ | 3.41${}^{+0.68}_{-1.38}$ | 3.4${}^{+1.4}_{-1.9}$ | 7.7${}^{+0.2}_{-0.1}$ | 7.0${}^{+0.3}_{-0.1}$ | 42.4/48
XMM | 0853980201 | 58783.33 | 35.0 (55) | 0.687$\pm$0.004 | 0.3-9.0 | 0.146${}^{+0.006}_{-0.006}$ | 170${}^{+32}_{-25}$ | 2.07${}^{+0.06}_{-0.06}$ | 22.6${}^{+1.4}_{-1.4}$ | 15.7${}^{+0.1}_{-0.2}$ | 13.3${}^{+0.1}_{-0.2}$ | 192.0/155
XMM | 0911790601 | 59719.89 | 8.2 (29) | 0.175$\pm$0.005 | 0.3-5.0 | 0.095${}^{+0.035}_{-0.032}$ | 211${}^{+1700}_{-173}$ | 2.35${}^{+0.19}_{-0.22}$ | 8.6${}^{+0.8}_{-1.1}$ | 3.7${}^{+0.3}_{-0.3}$ | 3.2${}^{+0.3}_{-0.3}$ | 72.1/82
XMM | 0911791401 | 59739.84 | 3.1 (10.6) | 0.130$\pm$0.009 | 0.3-0.8 | $\cdots$ | $\cdots$ | 2.77${}^{+0.54}_{-0.54}$ | 11.1${}^{+4.4}_{-3.4}$ | 4.4${}^{+1.4}_{-0.6}$ | 3.7${}^{+0.8}_{-0.6}$ | 15.0/11
XMM | 0921510101 | 60102.76 | 8.8 (43.1) | 0.011$\pm$0.001 | 0.3-1.0 | $\cdots$ | $\cdots$ | 1.96${}^{+0.86}_{-0.88}$ | 1.1${}^{+0.6}_{-0.4}$ | 0.6${}^{+0.7}_{-0.2}$ | 0.5${}^{+0.3}_{-0.2}$ | 19.1/16
Chandra§§§ | 28294 | 60227.71 | 32.6 (33) | (3.8$\pm$1.2)$\times$10-4 | 0.5-7.0 | $\cdots$ | $\cdots$ | 1.96 | 0.18${}^{+0.08}_{-0.06}$ | 0.09${}^{+0.01}_{-0.02}$ | 0.07${}^{+0.02}_{-0.01}$ | 38.5/56
Chandra§§§ | 28972 | 60228.58 | 19.8 (20) | (5.0$\pm$1.7)$\times$10-4 | 0.5-7.0 | $\cdots$ | $\cdots$ | 1.96 | 0.18${}^{+0.08}_{-0.06}$ | 0.09${}^{+0.01}_{-0.02}$ | 0.07${}^{+0.02}_{-0.01}$ | ”

## References

  * Ajay et al. (2024) Ajay, Y., Pasham, D. R., Wevers, T., et al. 2024, arXiv e-prints, arXiv:2401.12908, doi: 10.48550/arXiv.2401.12908
  * Andreoni et al. (2022) Andreoni, I., Coughlin, M. W., Perley, D. A., et al. 2022, Nature, 612, 430, doi: 10.1038/s41586-022-05465-8
  * Arnaud (1996) Arnaud, K. A. 1996, in Astronomical Society of the Pacific Conference Series, Vol. 101, Astronomical Data Analysis Software and Systems V, ed. G. H. Jacoby & J. Barnes, 17
  * Bade et al. (1996) Bade, N., Komossa, S., & Dahlem, M. 1996, A&A, 309, L35
  * Bandopadhyay et al. (2024a) Bandopadhyay, A., Coughlin, E. R., Nixon, C. J., & Pasham, D. R. 2024a, arXiv e-prints, arXiv:2406.03675, doi: 10.48550/arXiv.2406.03675
  * Bandopadhyay et al. (2024b) Bandopadhyay, A., Fancher, J., Athian, A., et al. 2024b, ApJ, 961, L2, doi: 10.3847/2041-8213/ad0388
  * Bellm (2014) Bellm, E. 2014, in The Third Hot-wiring the Transient Universe Workshop, ed. P. R. Wozniak, M. J. Graham, A. A. Mahabal, & R. Seaman, 27–33.  https://arxiv.org/abs/1410.8185
  * Bloom et al. (2011) Bloom, J. S., Giannios, D., Metzger, B. D., et al. 2011, Science, 333, 203, doi: 10.1126/science.1207150
  * Bricman & Gomboc (2020) Bricman, K., & Gomboc, A. 2020, ApJ, 890, 73, doi: 10.3847/1538-4357/ab6989
  * Brown et al. (2015) Brown, G. C., Levan, A. J., Stanway, E. R., et al. 2015, MNRAS, 452, 4297, doi: 10.1093/mnras/stv1520
  * Burrows et al. (2005) Burrows, D. N., Hill, J. E., Nousek, J. A., et al. 2005, Space Sci. Rev., 120, 165, doi: 10.1007/s11214-005-5097-2
  * Cendes et al. (2023) Cendes, Y., Berger, E., Alexander, K. D., et al. 2023, arXiv e-prints, arXiv:2308.13595, doi: 10.48550/arXiv.2308.13595
  * Coughlin & Armitage (2018) Coughlin, E. R., & Armitage, P. J. 2018, MNRAS, 474, 3857, doi: 10.1093/mnras/stx3039
  * Coughlin et al. (2017) Coughlin, E. R., Armitage, P. J., Nixon, C., & Begelman, M. C. 2017, MNRAS, 465, 3840, doi: 10.1093/mnras/stw2913
  * Coughlin & Nixon (2019) Coughlin, E. R., & Nixon, C. J. 2019, ApJ, 883, L17, doi: 10.3847/2041-8213/ab412d
  * Coughlin & Nixon (2022) —. 2022, MNRAS, 517, L26, doi: 10.1093/mnrasl/slac106
  * Cufari et al. (2022) Cufari, M., Coughlin, E. R., & Nixon, C. J. 2022, ApJ, 929, L20, doi: 10.3847/2041-8213/ac6021
  * Cufari et al. (2023) Cufari, M., Nixon, C. J., & Coughlin, E. R. 2023, MNRAS, 520, L38, doi: 10.1093/mnrasl/slad001
  * Donley et al. (2002) Donley, J. L., Brandt, W. N., Eracleous, M., & Boller, T. 2002, AJ, 124, 1308, doi: 10.1086/342280
  * Evans et al. (2023) Evans, P. A., Nixon, C. J., Campana, S., et al. 2023, Nature Astronomy, 7, 1368, doi: 10.1038/s41550-023-02073-y
  * Gafton et al. (2015) Gafton, E., Tejeda, E., Guillochon, J., Korobkin, O., & Rosswog, S. 2015, MNRAS, 449, 771, doi: 10.1093/mnras/stv350
  * Gehrels et al. (2004) Gehrels, N., Chincarini, G., Giommi, P., et al. 2004, ApJ, 611, 1005, doi: 10.1086/422091
  * Gezari (2021) Gezari, S. 2021, ARA&A, 59, 21, doi: 10.1146/annurev-astro-111720-030029
  * Golightly et al. (2019) Golightly, E. C. A., Coughlin, E. R., & Nixon, C. J. 2019, ApJ, 872, 163, doi: 10.3847/1538-4357/aafd2f
  * Grupe et al. (1995) Grupe, D., Beuerman, K., Mannheim, K., et al. 1995, A&A, 300, L21, doi: 10.48550/arXiv.astro-ph/9506087
  * Guillochon et al. (2016) Guillochon, J., McCourt, M., Chen, X., Johnson, M. D., & Berger, E. 2016, ApJ, 822, 48, doi: 10.3847/0004-637X/822/1/48
  * Guillochon & Ramirez-Ruiz (2013) Guillochon, J., & Ramirez-Ruiz, E. 2013, ApJ, 767, 25, doi: 10.1088/0004-637X/767/1/25
  * Guolo et al. (2024) Guolo, M., Pasham, D. R., Zajaček, M., et al. 2024, Nature Astronomy, 8, 347, doi: 10.1038/s41550-023-02178-4
  * Johnson et al. (2021) Johnson, B. D., Leja, J., Conroy, C., & Speagle, J. S. 2021, ApJS, 254, 22, doi: 10.3847/1538-4365/abef67
  * Kara et al. (2018) Kara, E., Dai, L., Reynolds, C. S., & Kallman, T. 2018, MNRAS, 474, 3593, doi: 10.1093/mnras/stx3004
  * Kosec et al. (2023) Kosec, P., Pasham, D., Kara, E., & Tombesi, F. 2023, ApJ, 954, 170, doi: 10.3847/1538-4357/aced87
  * Liu et al. (2023a) Liu, C., Mockler, B., Ramirez-Ruiz, E., et al. 2023a, ApJ, 944, 184, doi: 10.3847/1538-4357/acafe1
  * Liu et al. (2024) Liu, C., Yarza, R., & Ramirez-Ruiz, E. 2024, arXiv e-prints, arXiv:2406.01670, doi: 10.48550/arXiv.2406.01670
  * Liu et al. (2023b) Liu, Z., Malyali, A., Krumpe, M., et al. 2023b, A&A, 669, A75, doi: 10.1051/0004-6361/202244805
  * Mainetti et al. (2017) Mainetti, D., Lupi, A., Campana, S., et al. 2017, A&A, 600, A124, doi: 10.1051/0004-6361/201630092
  * Manukian et al. (2013) Manukian, H., Guillochon, J., Ramirez-Ruiz, E., & O’Leary, R. M. 2013, ApJ, 771, L28, doi: 10.1088/2041-8205/771/2/L28
  * Miles et al. (2020) Miles, P. R., Coughlin, E. R., & Nixon, C. J. 2020, ApJ, 899, 36, doi: 10.3847/1538-4357/ab9c9f
  * Nixon & Coughlin (2022) Nixon, C. J., & Coughlin, E. R. 2022, ApJ, 927, L25, doi: 10.3847/2041-8213/ac5118
  * Nixon et al. (2021) Nixon, C. J., Coughlin, E. R., & Miles, P. R. 2021, ApJ, 922, 168, doi: 10.3847/1538-4357/ac1bb8
  * Pasham & van Velzen (2018) Pasham, D. R., & van Velzen, S. 2018, ApJ, 856, 1, doi: 10.3847/1538-4357/aab361
  * Pasham et al. (2015) Pasham, D. R., Cenko, S. B., Levan, A. J., et al. 2015, ApJ, 805, 68, doi: 10.1088/0004-637X/805/1/68
  * Pasham et al. (2023) Pasham, D. R., Lucchini, M., Laskar, T., et al. 2023, Nature Astronomy, 7, 88, doi: 10.1038/s41550-022-01820-x
  * Payne et al. (2021) Payne, A. V., Shappee, B. J., Hinkle, J. T., et al. 2021, ApJ, 910, 125, doi: 10.3847/1538-4357/abe38d
  * Payne et al. (2022) —. 2022, ApJ, 926, 142, doi: 10.3847/1538-4357/ac480c
  * Payne et al. (2023) Payne, A. V., Auchettl, K., Shappee, B. J., et al. 2023, ApJ, 951, 134, doi: 10.3847/1538-4357/acd455
  * Planck Collaboration et al. (2020) Planck Collaboration, Aghanim, N., Akrami, Y., et al. 2020, A&A, 641, A6, doi: 10.1051/0004-6361/201833910
  * Price et al. (2024) Price, D. J., Liptai, D., Mandel, I., et al. 2024, arXiv e-prints, arXiv:2404.09381, doi: 10.48550/arXiv.2404.09381
  * Rees (1988) Rees, M. J. 1988, Nature, 333, 523, doi: 10.1038/333523a0
  * Sazonov et al. (2021) Sazonov, S., Gilfanov, M., Medvedev, P., et al. 2021, MNRAS, 508, 3820, doi: 10.1093/mnras/stab2843
  * Schlafly & Finkbeiner (2011) Schlafly, E. F., & Finkbeiner, D. P. 2011, ApJ, 737, 103, doi: 10.1088/0004-637X/737/2/103
  * Shappee et al. (2014) Shappee, B. J., Prieto, J. L., Grupe, D., et al. 2014, ApJ, 788, 48, doi: 10.1088/0004-637X/788/1/48
  * Sironi & Tran (2024) Sironi, L., & Tran, A. 2024, arXiv e-prints, arXiv:2402.13317, doi: 10.48550/arXiv.2402.13317
  * Somalwar et al. (2023) Somalwar, J. J., Ravi, V., Yao, Y., et al. 2023, arXiv e-prints, arXiv:2310.03782, doi: 10.48550/arXiv.2310.03782
  * Tonry et al. (2018) Tonry, J. L., Denneau, L., Heinze, A. N., et al. 2018, PASP, 130, 064505, doi: 10.1088/1538-3873/aabadf
  * van Velzen et al. (2011) van Velzen, S., Farrar, G. R., Gezari, S., et al. 2011, ApJ, 741, 73, doi: 10.1088/0004-637X/741/2/73
  * Wen et al. (2024) Wen, S., Jonker, P. G., Levan, A. J., et al. 2024, arXiv e-prints, arXiv:2405.00894, doi: 10.48550/arXiv.2405.00894
  * Wevers et al. (2024) Wevers, T., Guolo, M., Pasham, D. R., et al. 2024, ApJ, 963, 75, doi: 10.3847/1538-4357/ad1878
  * Wevers et al. (2019) Wevers, T., Pasham, D. R., van Velzen, S., et al. 2019, MNRAS, 488, 4816, doi: 10.1093/mnras/stz1976
  * Wevers et al. (2021) —. 2021, ApJ, 912, 151, doi: 10.3847/1538-4357/abf5e2
  * Wevers et al. (2023) Wevers, T., Coughlin, E. R., Pasham, D. R., et al. 2023, ApJ, 942, L33, doi: 10.3847/2041-8213/ac9f36
  * Yalinewich et al. (2019) Yalinewich, A., Steinberg, E., Piran, T., & Krolik, J. H. 2019, MNRAS, 487, 4083, doi: 10.1093/mnras/stz1567
  * Yao et al. (2024) Yao, Y., Lu, W., Harrison, F., et al. 2024, ApJ, 965, 39, doi: 10.3847/1538-4357/ad2b6b
  * Yao et al. (2023) Yao, Y., Ravi, V., Gezari, S., et al. 2023, ApJ, 955, L6, doi: 10.3847/2041-8213/acf216


# Privacy Considerations for Risk-Based Authentication Systems††thanks: This
research was supported by the research training group “Human Centered Systems
Security” (NERD.NRW) sponsored by the state of North Rhine-Westphalia.

Stephan Wiefling1, Jan Tolsdorf, and Luigi Lo Iacono  H-BRS University of
Applied Sciences, Sankt Augustin, Germany
1Ruhr University Bochum, Bochum, Germany
<EMAIL_ADDRESS>
###### Abstract

Risk-based authentication (RBA) extends authentication mechanisms to make them
more robust against account takeover attacks, such as those using stolen
passwords. RBA is recommended by NIST and NCSC to strengthen password-based
authentication, and is already used by major online services. Also, users
consider RBA to be more usable than two-factor authentication and just as
secure. However, users currently obtain RBA’s high security and usability
benefits at the cost of exposing potentially sensitive personal data (e.g., IP
address or browser information). This conflicts with user privacy and requires
to consider user rights regarding the processing of personal data.

We outline potential privacy challenges regarding different attacker models
and propose improvements to balance privacy in RBA systems. To estimate the
properties of the privacy-preserving RBA enhancements in practical
environments, we evaluated a subset of them with long-term data from 780 users
of a real-world online service. Our results show the potential to increase
privacy in RBA solutions. However, it is limited to certain parameters that
should guide RBA design to protect privacy. We outline research directions
that need to be considered to achieve a widespread adoption of privacy
preserving RBA with high user acceptance.

###### Index Terms:

Password, Risk-based Authentication, Usable Security and Privacy, Big Data
Analysis

(0cm,-7cm) 2021 IEEE European Symposium on Security and Privacy Workshops
(EuroS&PW) 0.5(0cm,20.6cm) © 2022 Stephan Wiefling, Jan Tolsdorf, Luigi Lo
Iacono
Open Access version of a paper published at IWPE ’21.
DOI: 10.1109/EuroSPW54576.2021.00040

##  1 Introduction

Passwords are still predominant for authentication with online services [25],
although new threats are constantly emerging. Credential stuffing and password
spraying attacks [14] use leaked login credentials (username and password)
sourced from data breaches, and try them in some way on (other) online
services. These attacks are very popular today [2] since attackers can
automate them with little effort. Major online services responded to this
threat with implementing risk-based authentication (RBA) [36], aiming to
strengthen password-based authentication with little impact on the user.

#### Risk-Based Authentication (RBA)

RBA determines whether a login attempt is a legitimate one or an account
takeover attempt. To do so, RBA monitors additional features when users submit
their login credentials. Popular features range from network (e.g., IP
address), device (e.g., smartphone model and operating system), or client
(e.g., browser vendor and version), to (behavioral) biometric information
(e.g., login time) [34, 36]. Based on the feature values and those of previous
logins, RBA calculates a risk score. An access threshold typically classifies
the score into low, medium, and high risk [12, 15, 21]. On a low risk (e.g.,
usual device and location), the RBA system grants access with no further
intervention. On a medium or higher risk (e.g., unusual device and location),
RBA requests additional information from the user, e.g., verifying the email
address. After providing the correct proof, access is granted.

RBA is considered a scalable interim solution when passwords cannot simply be
replaced by more secure authentication methods in many cases [35, 34]. The
National Institute of Standards and Technology (NIST, USA) and National Cyber
Security Centre (NCSC, UK) recommend RBA to mitigate attacks involving stolen
passwords [13, 23]. Beyond that, users found RBA more usable than equivalent
two-factor authentication (2FA) variants and comparably secure [35]. Also, in
contrast to 2FA, RBA both offers good security and rarely requests additional
authentication in practice [34], reducing the burden on users.

#### Research Questions

However, users obtain the security and usability gain of RBA at the cost of
disclosing more potentially sensitive data with a personal reference, such as
IP addresses and browser identifiers. Therefore, user privacy is at risk when
RBA databases are forwarded or breached, as additional data besides usernames
would potentially allow to identify individuals.

More and more data protection laws aim to protect users from massive data
collection by online services. Considering that, we wondered whether and to
what extent the integration of RBA systems complies with the principles of
modern data protection. We also wondered which trade-offs are possible to
balance security and privacy goals.

To further investigate RBA’s privacy aspects, we formulated the following
research questions:

  1. RQ1:

    1. a)

In what ways can RBA features be stored to increase the user privacy?

    2. b)

How can RBA features be stored to protect user privacy in terms of data
breaches?

  2. RQ2:

To what extent can a RBA feature maintain good security while preserving
privacy in practice?

#### Contributions

We propose and discuss five privacy enhancements that can be used by RBA
models used by the majority of deployments found in practice. To estimate
their usefulness in practice, we evaluated a subset of these enhancements on a
RBA feature that is highly relevant in terms of security and privacy, i.e.,
the IP address. We evaluated with a data set containing the login history of
780 users on a real-world online service for over 1.8 years.

Our results show for the first time that it is possible to increase feature
privacy while maintaining RBA’s security and usability properties. However,
increasing privacy is limited to certain conditions that need to be considered
while designing the RBA system. We also identified future challenges and
research directions that might arise with a widespread RBA adoption in the
future.

The results support service owners to provide data protection compliant RBA
solutions. They assist developers in designing RBA implementations with
increased privacy. Researchers gain insights on how RBA can become more
privacy friendly, and further research directions.

##  2 Background

In the following section, we provide a brief introduction to RBA and explain
how the use of RBA correlates with the several privacy principles defined by
industry standards and legislation.

###  2.1 RBA Model

Since RBA is not a standardized procedure, multiple solutions exist in
practice. We focus on the implementation by Freeman et al. [12], since it
performed best in a previous study [34]. Also, this RBA model is known to be
widely used, e.g., by popular online services like Amazon, Google, and
LinkedIn [36, 34].

The model calculates the risk score $S$ for a user $u$ and a set of feature
values $(FV^{1},...,FV^{d})$ with $d$ features as:

$S_{u}(FV)=\left(\prod_{k=1}^{d}\frac{p(FV^{k})}{p(FV^{k}|u,legit)}\right)\frac{p(u|attack)}{p(u|legit)}$
(1)

$S$ has the probabilities $p(FV^{k})$ that a feature value appears in the
global login history of all users, and $p(FV^{k}|u,legit)$ that a legitimate
user has this feature value in its own login history. The probability
$p(u|attack)$ describes how likely the user is being attacked, and
$p(u|legit)$ describes how likely the legitimate user is logging in.

###  2.2 Regulatory Foundations

In the past few years, the introduction of new data protection laws, such as
the General Data Protection Regulation (GDPR) [8] and the California Consumer
Privacy Act (CCPA) [30], dramatically changed the way online services (i.e.,
data controllers) process their users’ data. Formerly loose recommendations on
handling user data have been replaced by clear and binding data protection
principles, which data controllers must adhere to. However, the details and
scope of the principles vary between jurisdictions. For internationally
operating data controllers, this poses the problem that their data processing
operations must be designed to be compatible with different requirements.
Fortunately, the privacy framework specified in ISO 29100:2011 [16] already
compiles an intersection of privacy principles from data protection laws
worldwide. Thus, it provides data controllers a solid basis for designing
legally compliant data processing operations that can be tailored to the
details of different jurisdictions. We outline the requirements for the design
of RBA systems based on the privacy principles defined in ISO 29100:2011,
aiming at compatibility with different jurisdictions.

Applicability of Privacy Principles. Generally speaking, the privacy
principles defined in established privacy laws and frameworks aim to protect
the privacy of individuals. Thus, they only apply to data with a personal
reference. Such data are called, e.g., _“personal data”_ (GDPR [8]),
_“personal information”_ (CCPA [30]), or _“personally identifiable
information”_ (PII) (ISO [16]). The definitions are very similar and usually
refer to _“any information that (a) can be used to identify [an individual] to
whom such information relates, or (b) is or might be directly or indirectly
linked to [an individual]”_ [16].

The data processed by RBA certainly fall within this definition, since
implementations rely on features that already serve as (unique) identifiers by
themselves (e.g., IP address) [36]. Also, the risk score calculated by RBA
represents an identifier by itself, as it constitutes a set of characteristics
that uniquely identifies an individual. Therefore, RBA has to comply with ISO
29100:2011’s privacy principles discussed below.

Consent and Choice. In general, data controllers must ensure the lawfulness of
data processing. While most jurisdictions recognize user consent as a lawful
basis, applicable laws may allow processing without consent. Depending on the
assets associated with a user account, data controllers may argue that RBA use
is required to comply with the obligation to implement appropriate technical
safeguards against unauthorized access. Nonetheless, to ensure compliance,
providers should design RBA mechanisms with consent in mind and provide their
users with clear and easy-to-understand explanations.

Collection Limitation and Data Minimization. Data controllers must limit the
PII collection and processing to what is necessary for the specified purposes.
RBA feature sets should therefore be reviewed for suitability with redundant
or inappropriate features removed [34]. This includes considering using
pseudonymized data for RBA and disposing of the feature values when they are
no longer useful for the purpose of RBA. In practice, this creates the
challenge to not reduce a risk score’s reliability.

Use, Retention, and Disclosure Limitation. The data processing must be limited
to purposes specified by the data controller, and data must not be disclosed
to recipients other than specified. RBA should ensure that features cannot be
used for purposes other than the calculation of risk scores. Moreover, after a
feature value becomes outdated, it should be securely destroyed or anonymized.
We would point out that privacy laws do not apply to anonymized data and could
therefore serve data controllers for developing and testing purposes beyond
the retention period specified in their privacy statements.

Accuracy and Quality. Data controllers must ensure that the processed data are
accurate and of quality. This is not only due to their own business interests,
but also because data subjects have a right to expect their data being
correct. This directly affects RBA, since it has the power to deny a
significant benefit to users (i.e., access to their user account) with
potentially significant harm. Data controllers must hence ensure by
appropriate means that the stored feature values are correct and valid.

Individual Participation and Access. Data controllers must allow data subjects
to access and review their PII. For RBA, this means that users should be
allowed to be provided with a copy of the feature values used.

Information Security. Data controllers are obliged to protect PII with
appropriate controls at the operational, functional, and strategic level
against risks. These include, but are not limited to, risks associated with
unauthorized access or processing and denial of service. Privacy laws demand
extensive protections in this regard, _“taking into account the state of the
art, the costs of implementation and the nature, scope, context and purposes
of processing as well as the risk of varying likelihood and severity for the
rights and freedoms of natural persons”_ (Art. 32 (1) GDPR). Since RBA risk
scores do not necessarily rely on evaluating plain text feature values [34],
the collected data should be stored in an appropriate pseudonymized, masked,
truncated, or encrypted form, depending on the RBA implementation. Moreover,
data controllers should implement additional technical and organizational
measures as needed, and be able to ensure the integrity, availability, and
resilience of RBA.

Accountability and Privacy Compliance. Data controllers should inform data
subjects about privacy-related policies, transfers of PII to other countries,
and data breaches. Data controllers should also implement organizational
measures to help them verify and demonstrate legal compliance. These include,
but are not limited to, risk assessments and recovery procedures. RBA
implementations should therefore consider the worth of RBA features to both
attackers and data subjects, and the recovery from data breaches. This is
crucial in order not to undermine the security of user accounts and their
associated assets.

##  3 Privacy Enhancements (RQ1)

To comply with the privacy principles and derived data protection
requirements, service owners should consider mechanisms to increase privacy in
their RBA implementations. In the following, we introduce threats and their
mitigation to increase privacy properties of RBA features.

###  3.1 Feature Sensitivity and Impact Level

RBA feature sets always intend to distinguish attackers from legitimate users.
In doing so, the features may contain sensitive PII. However, not only do
users perceive such PII differently regarding their sensitivity [28]. Their
(unintended) disclosure could also have far-reaching negative consequences for
user privacy. Developers and providers should therefore determine the impact
from a loss of confidentiality of the RBA feature values. Specifically, the
following aspects need consideration [20]:

Identifiability and Linkability. RBA feature sets should be evaluated
regarding their ability to identify natural persons behind them. In
particular, RBA systems that rely on intrusive online tracking methods, such
as browser fingerprinting, store sensitive browser-specific information that
form a linked identifier. In the event of losing confidentiality, the features
would allow clear linkage between profiles at different online services,
despite users using different login credentials or pseudonyms. Depending on
the service, this could result in negative social or legal consequences for
individuals. It could also enable more extensive and unintended activity
tracking, and de-anonymizing information associated with user accounts.
Previous work found that powerful RBA feature sets do not require to uniquely
identify users when focusing on the detection of account takeover attempts
[34]. Also, users are more willing to accept the processing of sensitive
information when they are certain that it is anonymous and does not allow them
to be identified [18, 29]. Thus, the use of non-intrusive features may
increase user trust in online services, too.

Feature Values Sensitivity. Aside from identifying individuals by RBA feature
sets, the individual feature values may already contain sensitive PII.
Sensitive PII in the scope of RBA may be feature values that are easily
spoofable and can be misused to attack other online services in the event of a
data breach. Sensitive PII may also refer to data perceived as sensitive by
online users. For example, the most important feature of current RBA methods,
namely the IP address [34, 36, 12, 31, 15], is perceived as highly sensitive
by online users of diverse cultural backgrounds [19, 28, 3]. Since users are
generally less willing to share data with increased sensitivity, RBA feature
sets should limit the use of sensitive data if possible, in order to meet user
interests.

###  3.2 Threats

RBA features may contain personal sensitive data, which has to be protected
against attackers. To support online services in their protection efforts, we
introduce three privacy threat types. We based the threats on those found in
literature and our own observations in practice.

Data Misuse. Online services could misuse their own RBA feature data for
unintended purposes, such as user tracking, profiling, or advertising [5].
This type of misuse previously happened with phone numbers stored for 2FA
purposes [33]. While users have to trust online services to not misuse their
data, responsible online services should also take precautions to minimize
chances for miuse scenarios or unintended processing, e.g., by internal
misconduct or after the company changed the ownership.

Data Forwarding. Online services can be requested or forced to hand out stored
feature data, e.g., to state actors, advertising networks, or other third
parties. Especially IP addresses are commonly requested [9]. When such data
are forwarded to third parties, the users’ privacy is breached. For instance,
the IP address could be used to reveal the user’s geolocation or even their
identity.

Data Breach. Attackers obtained the database containing the feature values,
e.g., by hacking the online service. As a result, online services lost control
over their data. Attackers can try to re-identify users based on the feature
values, e.g., by combining them with other data sets. They can further try to
reproduce the feature values and try account takeover attacks on a large
scale, similar to credential stuffing. On success, they could access sensitive
user data stored on the online service, e.g., private messages.

###  3.3 Mitigation

Online services can implement several measures to mitigate the outlined
privacy threats. We propose five measures that are based on methods found in
related research fields, as well as privacy regulations and our own
observations with the selected RBA model (see Section 2). Based on the
introduced RBA model, we considered all feature values as categorical data, in
order to calculate the probabilities. When this condition is met, the proposed
measures are also applicable to other RBA models [34].

As an example for practical solutions, we describe how the considerations can
be applied to the _IP address_ feature, with regard to the IPv4 address. We
chose this feature since it is both considered the most important RBA feature
in terms of security to date and sensitive re-linkable data in terms of
privacy (see Section 3.1).

####  3.3.1 Aggregating

The RBA model only depends on feature value frequencies. To minimize data and
limit misuse [16], we can aggregate or reorder feature data in the login
history without affecting the results. The data set would then reveal how
often a feature combination occurred, but not its chronological order.
Removing this information can mitigate re-identification in login sequences.

####  3.3.2 Hashing

A cryptographic hash function, such as SHA-256, transforms a data input of
arbitrary value to an output of fixed length. As inverting a hash function is
not possible in theory, attackers need to recalculate all possible hashing
values to restore the input values [17]. Assuming that the hashes are
practically collision-free, using hashed feature values will produce the same
RBA results as with the original values. This is the case, because the feature
values are only transformed into a different representation. Therefore, this
could be a solution to protect feature data in terms of the outlined threats.

However, the IPv4 address has 32 bit limited input values, where some
addresses have a specific semantic and purpose, and cannot be assigned to
devices. Thus, attackers can simply hash all $2^{32}-1$ values to restore the
correct IP address. To counteract this problem, we can append a large random
string (salt) to the input value:

$H(192.168.1.166\ ||\ salt)=243916...aad132$ (2)

Attackers need to guess the salt correctly, which is high effort when the salt
is large. Thus, this mitigation strategy increases the required guessing time
for each feature value. Taking it a step further, we can even hash the results
multiple times to increase the computation time:

$H(H(...H(192.168.1.166\ ||\ salt)))=[hash]$ (3)

This is similar to key derivation strategies used in password databases [22].
However, we can only use a global salt for all database entries, as RBA
mechanisms need to be able to identify identical feature values across users
in the database. By increasing the computational cost, attackers cannot scale
attacks as they would have with the unhashed feature values.

####  3.3.3 Truncation

A more destructive approach to increase privacy for RBA features is to change
or remove details from their data values. This can reduce the number of
records with unique quasi identifiers. Since the feature data then becomes
less useful for other use cases like tracking or re-identification, we
consider it a measure to mitigate the privacy threats. Regarding the IP
address, we could set the last bits to zero. For truncating the last eight
bits, for example, this would result in:

$Truncate(192.168.1.166,8\ Bit)=192.168.1.0$ (4)

This mechanism is known from IP address anonymization strategies [7, 6].
However, we can also apply it on other features, e.g., reducing timing
precision or coarse-graining browser version number in the user agent string
[24]. Since we remove information that could potentially identify an
individual, e.g., the device’s internet connection, this can potentially
increase privacy. However, this can also influence the RBA results, as there
are fewer feature values for attackers to guess.

####  3.3.4 K-Anonymity

The k-anonymity privacy concept [32] ensures that at least $k$ entries in a
data set have the same quasi identifier values. If attackers obtained the data
set and know a victim’s IP address, they would not be able to distinguish the
person from $k$ other users. This makes it an effective countermeasure against
re-identification in case of data forwarding and data breaches.

To achieve k-anonymity for RBA, at least $k$ users need to have the same
feature value. To ensure this, we added potentially missing entries to the RBA
login history after each successful login. We added these entries to random
users to only affect the global login history probabilities in order to keep a
high security level. We created these users just for this purpose. To retain
the global data set properties, the user count increased gradually to have the
same mean number of login attempts per user.

####  3.3.5 Login History Minimization

Another approach is to limit the login history, in terms of the amount of
features and entries, for a number of entries or a constant time period [16].
A study already showed that few entries are sufficient to achieve a high RBA
protection [34]. In so doing, we mitigate tracking users for an extended
period of time. However, this can affect the RBA performance based on the
usage pattern of the corresponding online service. Especially when it is a
less-than-monthly-use online service, we assume that features need to be
stored for a longer period than for daily use websites to achieve a comparable
RBA performance.

##  4 Case Study Evaluation (RQ2)

Aggregating and hashing, when collision-free, does not affect the RBA results,
as they only change the data representation for the RBA model. The other
approaches, however, potentially could. To assess their impact on RBA behavior
in practice, we studied truncation and k-anonymity using real-world login
data. The properties and limited size of our data set did not allow to
reliably test the login history minimization approach, so we left it for
future work. Nevertheless, we outlined this relevant privacy consideration for
the sake of completeness. We used the IP address feature as in the other
examples.

###  4.1 Data Set

For the evaluation, we used our long-term RBA data set, including features of
780 users collected on a real-world online service [34]. The online service
collected the users’ features after each successful login. The users signed in
9555 times in total between August 2018 to June 2020. They mostly logged in
daily (44.3%) or several times a week (39.2%), with a mean of 12.25 times in
total. To improve data quality and validity, we removed all users who noticed
an illegitimate login in their account. The online service was an e-learning
website, which students used to exercise for study courses and exams. As the
users were mostly located in the same city, it is a very challenging data set
for RBA. They could get similar IP addresses with higher probability.
Therefore, it is important to evaluate how the RBA protection changes in such
a challenging scenario.

####  4.1.1 Legal and Ethical Considerations

The study participants [34] signed a consent form agreeing to the data
collection and use for study purposes. They were always able to view a copy of
their data and delete it on request. The collected data were stored on
encrypted hard drives and only the researchers had access to it.

We do not have a formal IRB process at our university. Still, we made sure to
minimize potential harm by complying with the ethics code of the German
Sociological Association (DGS) and the standards of good scientific practice
of the German Research Foundation (DFG). We also made sure to comply with the
GDPR.

####  4.1.2 Limitations

Our results are limited to the data set and the users who participated in the
study. They are limited to the population of a certain region of a certain
country. They are not representative for large-scale online services, but show
a typical use case scenario of a daily to weekly use website. As in similar
studies, we can never fully exclude that intelligent attackers targeted the
website. However, multiple countermeasures minimized the possibility that the
website was infiltrated [34].

###  4.2 Attacker Models

We evaluated the privacy enhancements using three RBA attacker models found in
related literature [34, 12]. All attackers possess the login credentials of
the target.

Naive attackers try to log in from a random Internet Service Providers (ISP)
from somewhere in the world. We simulated these attackers by using IP
addresses sourced from real-world attacks on online services [11].

VPN attackers know the country of the victim. Therefore, we simulated these
attackers with IP addresses from real-world attackers located in the victim’s
country [11].

Targeted attackers know the city, browser, and device of the victim.
Therefore, they choose similar feature values, including similar ISPs. We
simulated these attackers with our data set, with the unique feature
combinations from all users except the victim. Since the IP addresses of our
data set were in close proximity to each other, our simulated attacker was
aware of these circumstances and chose them in a similar way.

###  4.3 Methodology

In order to test our privacy enhancements in terms of practical RBA solutions,
we defined a set of desired properties. Our enhancements need to:  (A) Keep
the percentage of blocked attackers: The ability to block a high number of
attackers should not decrease when using the privacy enhancements. This is
necessary to keep the security properties of the RBA system.  (B) Retain
differentiation between legitimate users and attackers: When applied, the risk
score differences between legitimate users and attackers should only change
within a very small range. Otherwise, the usability and security properties of
the RBA system would decrease.

We outline the tests to evaluate the privacy enhancements below. Based on the
method in Wiefling et al. [34], we reproduced the login behavior for attackers
and legitimate users by replaying the user sessions. We integrated truncation
and k-anonymity in the reproduction process, to test the countermeasures.

The RBA model used the IP address and user agent string as features, since
this can be considered the RBA state of practice [36, 34]. We truncated the IP
addresses in ranges from 0 to 24 bits, to observe the effects on the RBA
performance. We assume that cutting more than 25 bits will not allow to
reliably detect attackers. We also tested k-anonymity with the IP address
feature until $k=6$. As US government agencies consider less than five entries
to be sensitive [10], we chose to cover this threshold.

####  4.3.1 Test A: Percentage of Blocked Attackers

To compare the RBA performance regarding all three attacker models, we
calculated the percentage of how many attackers would be blocked. We call this
percentage the _true positive rate_ (TPR), as previous work did [34, 12]. For
a fair comparison, we observed how the TPR changed when aiming to block 99.5%
of attackers. We chose this TPR baseline since it showed good performance
regarding usability and security properties in a previous study [34].

To ease comparison, we adjusted the TPR for each truncation or k-anonymity
step $x_{i}$ as percentage differences to the baseline without modifications
(relative TPR):

$TPR_{relative_{x_{i}}}=\frac{TPR_{x_{i}}-TPR_{baseline}}{TPR_{baseline}}$ (5)

Following that, $TPR_{relative_{x_{i}}}<0.0$ means that the TPR decreased
compared to the baseline.

####  4.3.2 Test B: Risk Score Changes

To determine the degree that attackers and legitimate users can be
differentiated in the RBA model, we calculated the _risk score relation_ (RSR)
[34]. It is the relation between the mean risk scores for attackers and
legitimate users:

$RSR_{basic}=\frac{mean\ attacker\ risk\ score}{mean\ legitimate\ risk\
score}$ (6)

To ease comparison, we normalized each RSR for every truncation or k-anonymity
step $x_{i}$ as percentage differences to the baseline (relative RSR). The
baseline is the IP address without modifications:

$RSR_{relative_{x_{i}}}=\frac{RSR_{basic_{x_{i}}}-RSR_{baseline}}{RSR_{baseline}}$
(7)

As a result, $RSR_{relative_{x_{i}}}<0.0$ signals that attackers and
legitimate users can no longer be distinguished as good as they were before
introducing the privacy enhancing measures.

####  4.3.3 Limit Extraction

For each test, we defined the following thresholds to extract limits that do
not degrade RBA performance to an acceptable extent.

(Test A) We require the RBA performance to remain constant. Thus, we selected
the reasonable limit as the point at which the relative TPR decreases compared
to the baseline, i.e., attackers cannot be blocked as good as before any more.
(Test B) Unlike tracking, RBA uses the feature information in addition to an
already verified identifier, e.g., passwords. Thus, we consider it feasible to
reduce the RSR slightly for the sake of privacy. Based on our observations,
RSR changes below 0.01 can be tolerable for our case study evaluation. Thus,
we chose the reasonable limit as the point at which the relative RSR is lower
than 0.01.

###  4.4 Results

In the following, we present the results for all attacker models. We discuss
the results after this section. We used a high performance computing cluster
using more than 2000 cores for the evaluation. This was necessary since
calculating the results with the simulated attackers was computationally
intensive.

For statistical testing, we used Kruskal-Wallis tests for the omnibus cases
and Dunn’s multiple comparison test with Bonferroni correction for post-hoc
analysis. We considered p-values less than 0.05 to be significant.

####  4.4.1 Truncation

Figure 1 shows the truncation test results for all attackers. The TPR
differences between the targeted attacker and both remaining attackers were
significant (Targeted/Naive: p=0.0151, Targeted/VPN: p$<$0.0001). The TPRs
exceeded the limit after 20 bits for naive, 3 bits for VPN, and 14 bits for
targeted attackers.

Figure 1: Results for truncating the IP address. Top: Relative TPR (Test A).
There were significant differences between targeted and both VPN and naive
attackers. Bottom: Relative RSR (Test B). The differences between VPN and both
targeted and naive attackers were significant.

Regarding the relative RSRs, there are significant differences between VPN and
both remaining attackers (p$<$0.0001). The RSRs exceeded the limit after 3
bits for naive, 21 bits for VPN, and 3 bits for targeted attackers.

Combining both results, the accepted truncation limits based on our criteria
were 3 bits for all attacker models.

####  4.4.2 K-Anonymity

Figure 2 shows the combined k-anonymity test results for the three attacker
models. The relative TPR decreased after $k=1$ for targeted attackers, $k=2$
for naive attackers, and not at all for VPN attackers until at least $k=6$.
There were significant TPR differences between naive and VPN attackers
(p=0.0066).

Figure 2: Results for k-anonymity regarding the IP address. Top: Relative TPR
(Test A). Differences between naive and VPN attackers were significant.
Bottom: Relative RSR (Test B). There were no significant differences.

The relative RSR did not decrease for all attacker types and there were no
significant differences.

Combining the results, the acceptable k levels based on our criteria were
$k=1$ for targeted attackers, $k=2$ for naive attackers, and at least $k=6$
for VPN attackers.

##  5 Discussion

Our results show that IP address truncation significantly affects the RBA risk
score and reduces the probability of attack detection. The truncation for VPN
attackers resulted in a local maximum of the RSR at 12 bits, and thus
apparently improved detection. However, this was due to the fact that the VPN
attacker only had an IP address range limited to the VPN service’s server
locations. Since the first IP address bits correspond to a node’s geolocation,
they were mostly distinct from legitimate users residing in different areas.
Thus, truncating increased the risk scores for VPN attackers until 12 bit, as
the probability for the global login history $p(FV^{k})$ decreased but the one
for the local history $p(FV^{k}|u,legit)$ remained constant. In contrast to
that, targeted attackers also had a limited IP address range, but they were
located in the same region as the legitimate users. Also, naive attackers had
a large IP address range. Thus, in both cases, the differences between
$p(FV^{k})$ and $p(FV^{k}|u,legit)$ remained constant to similar levels until
12 bits.

Following that, and what our evaluation indicates, we do not recommend
truncating more than three bits for a stable RBA performance in our case study
scenario.

K-anonymity increased the distinguishability between legitimate users and
attackers, i.e., the RSR. This was due to the fact that this mechanism added
new entries to the global login history. As a result, the overall probability
for unknown feature values in the global login history $p(FV^{k})$ decreased,
making it harder for attackers to achieve a low risk score. However, this also
decreased the detection of attackers, i.e., the TPR, in most cases, since $k$
more users had similar feature values in the data set. As a side effect of
these results, unique feature values got less unique in total. Thus, due to
the determined limit of $k=1$, k-anonymity for targeted attackers can only be
achieved with degraded RBA performance.

The overhead produced by the additional entries increased with each $k$ (see
Table I). It was even more than the data set itself at k>3, which makes the
current mechanism impractical for very large online services. To mitigate this
issue, mechanisms could be introduced which remove some additional login
entries when k-anonymity can be fulfilled after some time.

TABLE I: Overhead created by additional login entries to achieve k-anonymity

k | Additional Entries | Increase to Baseline
---|---|---
1 | 0 | 0.0
2 | 3928 | 0.41
3 | 7965 | 0.83
4 | 12013 | 1.26
5 | 16065 | 1.68
6 | 20120 | 2.11

K-anonymity is not scalable with an increasing number of features [1], while
the other approaches are. Thus, sensible RBA privacy enhancements might be a
combination of all outlined countermeasures, to ensure scalability.

Based on our results, we discuss privacy challenges and further research
directions in the following.

###  5.1 Privacy Challenges

When integrating privacy into RBA systems, there are several challenges that
should be considered in practice. We describe them below.

Role of the IP Address Feature. Using a combination of privacy enhancements
for the IP address might be sufficient for some applications. However, this
feature is still sensitive information. Thus, the question arises whether
online services should consider privacy enhancing alternatives instead of
storing the IP address. One alternative could be to derive only the region and
ASN from the IP address, and discard the rest. Other approaches even enable
identifying network anomalies, e.g., IP spoofing using a VPN connection,
without having to rely on the IP address at all. For example, the server-
originated round-trip time (RTT) [34] can be used to estimate the distance
between the user’s device and the server location and may replace IP addresses
as RBA features. As the RTTs vary based on the server location, they become
useless for most re-identification attacks using leaked databases, as server
locations are distributed in practice. They can even be enriched with random
noise to further enhance privacy.

Risk of Feature Stuffing. Such considerations can be more and more important
with widespread RBA adoption in the future. We assume that when databases with
RBA feature values got stolen, this might have serious consequences for other
services using RBA. In contrast to passwords, behavioral RBA feature values
cannot be changed after compromise. Attackers can attempt to automatically
reproduce these feature values on other websites. Thus, more privacy
preserving alternatives that are hard to spoof for attackers might be crucial
to mitigate largely scalable “feature stuffing” attacks.

Handling Data Deletion Requests. Further conflicts could arise with data
protection regulations. Users are legally permitted to request data deletion.
So when they request online services to delete their RBA feature data, they
might lose RBA protection on their user accounts.

###  5.2 Research Directions

Our case study evaluation provided first insights on truncating feature values
to increase privacy. As the results showed that this is possible to a certain
degree while maintaining RBA performance, further work can investigate it for
other types of features, e.g., the user agent string.

The proposed k-anonymity mechanism can increase privacy regarding unique
entries in the data set. However, users might still be identifiable when they
have a combination of typical feature values, e.g., a home and a work IP
address. This non-trivial task had been addressed in dynamic databases [27,
37]. Future work may investigate whether such mechanisms are also applicable
to RBA.

As we could not reliably test the login history minimization approach with our
data set, future work should investigate this on a medium to large-scale
online service with regular use.

##  6 Related Work

Burkhard et al. [6] investigated truncating IP addresses in anomaly detection
systems. They found that truncating more than four bits degraded the
performance of these systems. Chew et al. [7] further evaluated IP truncation
in intrusion detection systems. Their results showed that the detection
accuracy in many of the tested classifiers decreased after removing more than
8 bits. Our study showed that three bits could be removed from the IP address
to maintain RBA performance at the same time.

Both Safa et al. [26], and Blanco-Justicia and Domingo-Ferrer [4] proposed
privacy-preserving authentication models for implicit authentication using
mobile devices. Their models relied on client-originated features, and the
former also calculated risk scores on the client’s device. However, this is
not applicable to our RBA use case, as it relies on server-originated features
and risk scores to prevent client-side spoofing.

To the best of our knowledge, there were no studies investigating privacy
enhancements in RBA systems. However, some literature touched on privacy
aspects related to RBA. Bonneau et al. [5] discussed privacy concerns of using
additional features for authentication. They found that privacy preserving
techniques might mitigate these concerns, but these had not been deployed in
practice. We proposed and tested some techniques for the first time in our
case study. Wiefling et al. [35] investigated RBA’s usability and security
perceptions. The results showed that users tended to reject providing phone
numbers to online services for privacy reasons. They further studied RBA
characteristics on a real-world online service [34], showing that the feature
set can be very small to achieve good RBA performance. We demonstrated that
the privacy can be further enhanced through different mechanisms.

##  7 Conclusion

With a widespread use of RBA to protect users against attacks involving stolen
credentials, more and more online services will potentially store sensitive
feature data of their users, like IP addresses and browser identifiers, for
long periods of time. Whenever such information is forwarded or leaked, it
poses a potential threat to user privacy. To mitigate such threats, the design
of RBA systems must balance security and privacy.

Our study results provide a first indication that RBA implementations used in
current practice can be designed to become more privacy friendly. However,
there are still challenges that have not been resolved in research to date. An
important question is, e.g., how the IP address feature can be replaced with
more privacy preserving alternatives. On the one hand, we assume that the IP
address is very relevant for re-identification attacks [9]. Discarding it from
the RBA login history can therefore increase privacy protection. On the other
hand, the IP address is a feature providing strong security [34]. Future
research must carefully identify and analyze such trade-offs, so that RBA’s
user acceptance does not drop with the first data breach.

## References

  * [1] C. C. Aggarwal, “On k-Anonymity and the Curse of Dimensionality,” in _VLDB ’05_. VLDB Endowment, Aug. 2005.
  * [2] Akamai, “Loyalty for Sale – Retail and Hospitality Fraud,” _[state of the internet] / security_ , vol. 6, no. 3, Oct. 2020.
  * [3] K. Almotairi and B. Bataineh, “Perception of Information Sensitivity for Internet Users in Saudi Arabia,” _AIP_ , vol. 9, no. 2, 2020.
  * [4] A. Blanco-Justicia and J. Domingo-Ferrer, “Efficient privacy-preserving implicit authentication,” _Computer Communications_ , vol. 125, Jul. 2018\.
  * [5] J. Bonneau, E. W. Felten, P. Mittal, and A. Narayanan, “Privacy concerns of implicit secondary factors for web authentication,” in _WAY ’14_ , Jul. 2014.
  * [6] M. Burkhart, D. Brauckhoff, M. May, and E. Boschi, “The risk-utility tradeoff for IP address truncation,” in _NDA ’08_. ACM, 2008.
  * [7] Y. J. Chew, S. Y. Ooi, K.-S. Wong, and Y. H. Pang, “Privacy Preserving of IP Address through Truncation Method in Network-based Intrusion Detection System,” in _ICSCA ’19_. ACM, 2019.
  * [8] European Union, “General Data Protection Regulation,” May 2016, Regulation (EU) 2016/679.
  * [9] Europol, “SIRIUS EU Digital Evidence Situation Report 2019,” Dec. 2019.
  * [10] Federal Committee on Statistical Methodology, “Report on Statistical Disclosure,” Dec. 2005.
  * [11] FireHOL, “All cybercrime ip feeds,” Aug. 2020. [Online]. Available: http://iplists.firehol.org/?ipset=firehol_level4
  * [12] D. Freeman, S. Jain, M. Dürmuth, B. Biggio, and G. Giacinto, “Who Are You? A Statistical Approach to Measuring User Authenticity,” in _NDSS ’16_. Internet Society, Feb. 2016.
  * [13] P. A. Grassi _et al._ , “Digital identity guidelines: authentication and lifecycle management,” National Institute of Standards and Technology, Tech. Rep. NIST SP 800-63b, Jun. 2017.
  * [14] M. J. Haber, “Attack Vectors,” in _Privileged Attack Vectors: Building Effective Cyber-Defense Strategies to Protect Organizations_. Apress, 2020.
  * [15] A. Hurkała and J. Hurkała, “Architecture of context-risk-aware authentication system for web environments,” in _ICIEIS ’14_ , 2014.
  * [16] ISO, _ISO/IEC 29100:2011(E): Information Technology — Security Techniques — Privacy Framework_. ISO/IEC, 2011.
  * [17] D. Llewellyn-Jones and G. Rymer, “Cracking PwdHash: A Bruteforce Attack on Client-side Password Hashing.” Apollo, 2017.
  * [18] E. Markos, L. I. Labrecque, and G. R. Milne, “A New Information Lens: The Self-concept and Exchange Context as a Means to Understand Information Sensitivity of Anonymous and Personal Identifying Information,” _JIM_ , vol. 42, 2018.
  * [19] E. Markos, G. R. Milne, and J. W. Peltier, “Information Sensitivity and Willingness to Provide Continua: A Comparative Privacy Study of the United States and Brazil,” _JPP &M_, 2017.
  * [20] E. McCallister, T. Grance, and K. A. Scarfone, “Guide to protecting the confidentiality of Personally Identifiable Information (PII),” Tech. Rep. NIST SP 800-122, 2010.
  * [21] I. Molloy, L. Dickens, C. Morisset, P.-C. Cheng, J. Lobo, and A. Russo, “Risk-based Security Decisions Under Uncertainty,” in _CODASPY ’12_. ACM, Feb. 2012.
  * [22] K. Moriarty, B. Kaliski, and A. Rusch, “Pkcs #5: Password-based cryptography specification version 2.1,” RFC 8018, January 2017.
  * [23] National Cyber Security Centre, “Cloud security guidance: 10, Identity and authentication,” Tech. Rep., Nov. 2018.
  * [24] G. Pugliese, C. Riess, F. Gassmann, and Z. Benenson, “Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective,” _PoPETS_ , vol. 2020, no. 2, Apr. 2020.
  * [25] N. Quermann, M. Harbach, and M. Dürmuth, “The State of User Authentication in the Wild,” in _WAY ’18_ , Aug. 2018.
  * [26] N. A. Safa, R. Safavi-Naini, and S. F. Shahandashti, “Privacy-Preserving Implicit Authentication,” in _IFIP SEC ’14_. Springer, 2014.
  * [27] J. Salas and V. Torra, “A General Algorithm for k-anonymity on Dynamic Databases,” in _DPM ’18_. Springer, 2018.
  * [28] E.-M. Schomakers, C. Lidynia, D. Müllmann, and M. Ziefle, “Internet users’ perceptions of information sensitivity – insights from Germany,” _IJIM_ , vol. 46, Jun. 2019.
  * [29] E.-M. Schomakers, C. Lidynia, and M. Ziefle, “All of me? Users’ preferences for privacy-preserving data markets and the importance of anonymity,” _Electronic Markets_ , vol. 30, no. 3, Feb. 2020.
  * [30] State of California, “California Consumer Privacy Act,” Jun. 2018, Assembly Bill No. 375.
  * [31] R. H. Steinegger, D. Deckers, P. Giessler, and S. Abeck, “Risk-based authenticator for web applications,” in _EuroPlop ’16_. ACM, Jun. 2016.
  * [32] L. Sweeney, “k-anonymity: A model for protecting privacy,” _IJUFKS_ , vol. 10, no. 05, Oct. 2002.
  * [33] G. Venkatadri, E. Lucherini, P. Sapiezynski, and A. Mislove, “Investigating sources of PII used in Facebook’s targeted advertising,” _PoPETS_ , vol. 2019, Jan. 2019.
  * [34] S. Wiefling, M. Dürmuth, and L. Lo Iacono, “What’s in Score for Website Users: A Data-driven Long-term Study on Risk-based Authentication Characteristics,” in _FC ’21_. Springer, Mar. 2021.
  * [35] S. Wiefling, M. Dürmuth, and L. Lo Iacono, “More Than Just Good Passwords? A Study on Usability and Security Perceptions of Risk-based Authentication,” in _ACSAC ’20_. ACM, Dec. 2020.
  * [36] S. Wiefling, L. Lo Iacono, and M. Dürmuth, “Is This Really You? An Empirical Study on Risk-Based Authentication Applied in the Wild,” in _IFIP SEC ’19_. Springer, Jun. 2019.
  * [37] X. Xiao and Y. Tao, “M-invariance: towards privacy preserving re-publication of dynamic datasets,” in _SIGMOD ’07_. ACM, 2007.