Biometric-based User Authentication Research Articles

A Secure Biometric-Based User Authentication Scheme for Cyber-Physical Systems in Healthcare

A Secure Biometric-Based User Authentication Scheme for Cyber-Physical Systems in Healthcare

A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones.

Mobile user authentication acts as the first line of defense, establishing confidence in the claimed identity of a mobile user, which it typically does as a precondition to allowing access to resources in a mobile device. NIST states that password schemes and/or biometrics comprise the most conventional user authentication mechanisms for mobile devices. Nevertheless, recent studies point out that nowadays password-based user authentication is imposing several limitations in terms of security and usability; thus, it is no longer considered secure and convenient for the mobile users. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Alternatively, biometric-based user authentication has gained attention as a promising solution for enhancing mobile security without sacrificing usability. This category encompasses methods that utilize human physical traits (physiological biometrics) or unconscious behaviors (behavioral biometrics). In particular, risk-based continuous user authentication, relying on behavioral biometrics, appears to have the potential to increase the reliability of authentication without sacrificing usability. In this context, we firstly present fundamentals on risk-based continuous user authentication, relying on behavioral biometrics on mobile devices. Additionally, we present an extensive overview of existing quantitative risk estimation approaches (QREA) found in the literature. We do so not only for risk-based user authentication on mobile devices, but also for other security applications such as user authentication in web/cloud services, intrusion detection systems, etc., that could be possibly adopted in risk-based continuous user authentication solutions for smartphones. The target of this study is to provide a foundation for organizing research efforts toward the design and development of proper quantitative risk estimation approaches for the development of risk-based continuous user authentication solutions for smartphones. The reviewed quantitative risk estimation approaches have been divided into the following five main categories: (i) probabilistic approaches, (ii) machine learning-based approaches, (iii) fuzzy logic models, (iv) non-graph-based models, and (v) Monte Carlo simulation models. Our main findings are summarized in the table in the end of the manuscript.

An improved biometric based user authentication and key agreement scheme for intelligent sensor based wireless communication

The new communication technologies have changed the traditional networks processes and provides more feasible, and convenient services for healthcare, agriculture, and transportation. Ad hoc networks devices have limited resources for energy, storage and processing. The conventional and traditional security solutions are not suitable for small and tiny sensor nodes. The symmetric cryptography method consumes more energy than public key cryptography method, whereas the public key cryptography method is a resource-intensive and not suitable for wireless networks. The symmetric cryptosystems have key management issues. Different authentication mechanisms have been designed but almost all of them are either complex or insecure. Improving network security with less resources consumption, there is a need to design and develop more advance and lightweight solution. This paper proposed a Biometric based User Authentication and Key Agreement Protocol (BUAKA) that uses a fuzzy extractor and one-way hash functions for sensor nodes authentication. The proposed scheme has four phases: initialization, registration, authentication, and password renewal phase. The proposed scheme resolves the complexities issues by providing a secure authentication mechanism and provide great resilience against a number of attacks. Finally, the proposed scheme is evaluated using several parameters such as security attacks, computational cost, and communication overhead to measure the effectiveness of proposed scheme.

A Secure Online Fingerprint Authentication System for Industrial IoT Devices over 5G Networks.

The development of 5G networks has rapidly increased the use of Industrial Internet of Things (IIoT) devices for control, monitoring, and processing purposes. Biometric-based user authentication can prevent unauthorized access to IIoT devices, thereby safeguarding data security during production. However, most biometric authentication systems in the IIoT have no template protection, thus risking raw biometric data stored as templates in central databases or IIoT devices. Moreover, traditional biometric authentication faces slow, limited database holding capacity and data transmission problems. To address these issues, in this paper we propose a secure online fingerprint authentication system for IIoT devices over 5G networks. The core of the proposed system is the design of a cancelable fingerprint template, which protects original minutia features and provides privacy and security guarantee for both entity users and the message content transmitted between IIoT devices and the cloud server via 5G networks.Compared with state-of-the-art methods, the proposed authentication system shows competitive performance on six public fingerprint databases, while saving computational costs and achieving fast online matching.

A novel approach for user authentication using keystroke dynamics

One Time Password (OTP) and Text Password are becoming less important in the current age of cybercrime because of the rapid development of new security systems. A user authentication system that is easy, robust, scalable, and cost-effective is a must. For both security and surveillance purposes, keystroke biometrics is a viable option. Behavior biometrics, of which keystroke biometrics is a subset, is used to identify individuals based on the way they type. Typing habits are not set in stone and are subject to change depending on the scenario, the device being used, and the user’s emotional state. As a result, the performance of a keystroke biometrics-based user authentication system is influenced by how well the retrieved information from typing and classification algorithms is processed. Using a keyboard with an array of pressure sensors, this research presents a unique way to keystroke dynamics-based authentication. The goal of this study is to develop user profiles that are unique and different in order to improve the suggested system’s efficiency. A real-world dataset is used to test the suggested method. The outcome is achieved with a 97% success rate in experiments.

Behavior-based user authentication on mobile devices in various usage contexts

Reliable and non-intrusive user identification and authentication on mobile devices, such as smartphones, are topical tasks today. The majority of state-of-the-art solutions in this domain are based on “device unlock” scenario—checking of information (authentication factors) provided by the user for unlocking a smartphone. As such factors, we may use either single strong authentication factor, for example, password or PIN, or several “weaker” factors, such as tokens, biometrics, or geolocation data. However, these solutions require additional actions from a user, for example, password typing or taking a fingerprint, that may be inappropriate for on-the-fly authentication. In addition, biometric-based user authentication systems tend to be prone to presentation attack (spoofing) and typically perform well in fixed positions only, such as still standing or sitting.We propose BehaviorID solution that is passwordless (transparent) user-adaptive context-dependent authentication method. The feature of BehaviorID is usage of new “device lock” scenario—smartphone is stayed unlocked and can be fast locked if non-owner’s actions are detected. This is achieved by tracking of user’s behavior with embedded sensors after triggering events, such as actions in banking apps, e-mails, and social services. The advanced adaptive recurrent neural network (A-RNN) is used for accurate estimation and adaptation of behavioral patterns to a new usage context. Thus, proposed BehaviorID solution allows reliable user authentication in various usage contexts by preserving low battery consumption.Performance evaluation of both state-of-the-art and proposed solutions in various usage contexts proved the effectiveness of BehaviorID in real situations. Proposed solution allows reducing error levels up to three times in comparison with modern Abuhamad’s solutions (Abuhamad et al., IEEE Internet Things J 7(6):5008–5020, 2020) (about 0.3% false acceptance rate (FAR) and 1.3% false rejection rate (FRR)) by preserving high robustness to spoofing attack (2.5% spoof acceptance rate (SAR)). In addition, BehaviorID showed low drift of error level in case of long-term usage in contrast to modern solutions. This makes the proposed BehaviorID solution an attractive candidate for next-generation behavior-based user authentication systems on mobile devices.

Draw-a-Deep Pattern: Drawing Pattern-Based Smartphone User Authentication Based on Temporal Convolutional Neural Network

Present-day smartphones provide various conveniences, owing to high-end hardware specifications and advanced network technology. Consequently, people rely heavily on smartphones for a myriad of daily-life tasks, such as work scheduling, financial transactions, and social networking, which require a strong and robust user authentication mechanism to protect personal data and privacy. In this study, we propose draw-a-deep-pattern (DDP)—a deep learning-based end-to-end smartphone user authentication method using sequential data obtained from drawing a character or freestyle pattern on the smartphone touchscreen. In our model, a recurrent neural network (RNN) and a temporal convolution neural network (TCN), both of which are specialized in sequential data processing, are employed. The main advantages of the proposed DDP are (1) it is robust to the threats to which current authentication systems are vulnerable, e.g., shoulder surfing attack and smudge attack, and (2) it requires few parameters for training; therefore, the model can be consistently updated in real-time, whenever new training data are available. To verify the performance of the DDP model, we collected data from 40 participants in one of the most unfavorable environments possible, wherein all potential intruders know how the authorized users draw the characters or symbols (shape, direction, stroke, etc.) of the drawing pattern used for authentication. Of the two proposed DDP models, the TCN-based model yielded excellent authentication performance with average values of 0.99%, 1.41%, and 1.23% in terms of AUROC, FAR, and FRR, respectively. Furthermore, this model exhibited improved authentication performance and higher computational efficiency than the RNN-based model in most cases. To contribute to the research/industrial communities, we made our dataset publicly available, thereby allowing anyone studying or developing a behavioral biometric-based user authentication system to use our data without any restrictions.

Multimodal Biometric-Based Secured Access Mechanism for Wireless Sensor Networks

Wireless Sensors Network’s (WSN) security is a critical concern owing to their unattended and intimidating distribution. Providing authentication to these networks with limited resources is a challenging task. Biometric based user authentication schemes with light computations and easy operations provide potential solutions. Several unimodal biometric techniques are proposed to secure WSN. Unimodal is susceptible to limited accuracy and spoofing. However, Multimodal biometric technology offers greater security. This paper proposes an algorithm combining fingerprint and iris biometric features for authentication. Registration and authentication processes using limited resources that are available at the WSN nodes are implemented. Experimentation results calculate computational overhead and are compared with existing methods.

Voter Authentication System Using Feature Level Fusion of Iris, Face and Palmprint

Abstract: The authentication scheme is an important cryptographic mechanism, through which two communication parties could authenticate each other in the open network environment. To satisfy the requirement of practical applications, many authenticationschemes using passwords and smart cards have been proposed. However,passwords might be divulged or forgotten, and smart cards might be shared, lost, or stolen. In contrast, biometric methods such as face or iris scans, have no such drawbacks. Three biometric traits are collected and stored into database at the time of enrollment. The Multimodel Biometric based user authentication systems are highly secured and efficient to use and place total trust on the authentication server where biometric verification data are stored in a database. Such systems are prone to dictionary attacks initiated at the server side. In thispaper, we propose an efficient approach based on multimodal biometrics-based user authentication and key exchange system. In this system,texture properties are extracted from the palm print, face and iris. Duringlogin procedure the mutual authentication is done between the user and server and a symmetric key is generated on both sides, which could be used for further secure communication between the user and the server can also be overcome. This system can be directly applied to strengthen existing password or biometric based systems without requiring additional computation.

Development, evaluation, and analysis of biometric-based bank vault user authentication system through brainwaves

Development, evaluation, and analysis of biometric-based bank vault user authentication system through brainwaves

Deep Q-Learning-Based Neural Network with Privacy Preservation Method for Secure Data Transmission in Internet of Things (IoT) Healthcare Application

The healthcare industry is being transformed by the Internet of Things (IoT), as it provides wide connectivity among physicians, medical devices, clinical and nursing staff, and patients to simplify the task of real-time monitoring. As the network is vast and heterogeneous, opportunities and challenges are presented in gathering and sharing information. Focusing on patient information such as health status, medical devices used by such patients must be protected to ensure safety and privacy. Healthcare information is confidentially shared among experts for analyzing healthcare and to provide treatment on time for patients. Cryptographic and biometric systems are widely used, including deep-learning (DL) techniques to authenticate and detect anomalies, andprovide security for medical systems. As sensors in the network are energy-restricted devices, security and efficiency must be balanced, which is the most important concept to be considered while deploying a security system based on deep-learning approaches. Hence, in this work, an innovative framework, the deep Q-learning-based neural network with privacy preservation method (DQ-NNPP), was designed to protect data transmission from external threats with less encryption and decryption time. This method is used to process patient data, which reduces network traffic. This process also reduces the cost and error of communication. Comparatively, the proposed model outperformed some standard approaches, such as thesecure and anonymous biometric based user authentication scheme (SAB-UAS), MSCryptoNet, and privacy-preserving disease prediction (PPDP). Specifically, the proposed method achieved accuracy of 93.74%, sensitivity of 92%, specificity of 92.1%, communication overhead of 67.08%, 58.72 ms encryption time, and 62.72 ms decryption time.

Recent advances in biometrics-based user authentication for wearable devices: A contemporary survey

In recent years, wearable technology is interwoven with our everyday lives because of its commoditization and comfort. Security and privacy become a big concern as many user-sensitive data have been stored in such devices, such as personal emails and bank accounts. Traditional user authentication techniques like PIN entry are unfriendly and vulnerable to shoulder surfing attacks. To address these problems, a number of new authentication methods have been proposed. In this survey, we review and categorize recent advances in user authentication for wearable devices. We classify existing studies into physiological biometrics based and behavioral biometrics based methods. For each category, we review how signal processing techniques have been used to extract features in various wearable devices. Leveraging these extracted features, specifically designed classification methods can be used to realize user authentication. Finally, we review evaluation metrics for user authentication in wearable devices. Overall, in this survey, we systematically study assorted state-of-the-art user authentication methods for wearable devices, aiming to provide guidance and directions for future research in this area.

Biometrics Based User Authentication Scheme for Multi-Server Environments

The critical security requirements include mutual authentication between a server and a user and creation of the session key that is used to maintain confidentiality of data through the key agreement scheme. This study proposes the improved user authentication scheme that can respond to the impersonation attack of an attacker, guaranteeing user’s anonymity and confidentiality of the session key by improving the problem that the user authentication scheme suggested by Moon et al. has, which is that the secret key of the registration center and a server and secret numbers selected by the registration center are easily exposed to an attacker. This study proposes the improved user authentication scheme that can respond to the impersonation attack of an attacker, guaranteeing user’s anonymity and confidentiality of the session key by improving the problem that the user authentication scheme suggested by Moon et al. has, which is that the secret key of the registration center and a server and secret numbers selected by the registration center are easily exposed to an attacker. Therefore, this study proposes dividing and saving the secret key SPSK in advance when it is registered at the registration center in order to prevent the secret key and secret numbers from being exposed to an attacker. Besides, it makes it impossible for an attacker to figure out the secret number x from a transformed number even though a message is wiretapped upon transmission by improving it in the way that the secret number x that is selected after a user requests registration is transformed to another number before transmission. The improved user authentication scheme proposed in this study is able to guarantee user’s anonymity, respond to attacks that attackers are impersonated as users or servers and that create the session key by using the intercepted messages.

Biometric Based User Authentication and Privacy Preserving In Cloud Environment

Cloud technology provides advantage of storage services for individuals and organizations thus making file access easy and simple irrespective of location. The major concern is the security while the file is been outsourced. Maintaining integrity, file unchanged, gaining confidentiality during file outsourced plays an important role. In this paper, we propose identity based data outsourcing technique to provide data security during authorization and storage. For data authorization we propose finger print based authentication. The fingerprint based authentication is performed using Minutae Map algorithm (MM). For data security we convert the data owner files to hash values using SHA algorithm. Finally in the cloud storage stage, data security and data availability is addressed using multiple cloud storage system.

Risk-Driven Behavioral Biometric-based One-Shot-cum-Continuous User Authentication Scheme

The paper presents a risk-driven behavioral biometric-based user authentication scheme for smartphones. Our scheme delivers one-shot-cum-continuous authentication, thus not only authenticates users at the start of the application sign-in process but also, throughout the active user session. The scheme leverages the widely used PIN/password-based authentication technology by giving flexibility to users to enter any random 8-digit alphanumeric text, instead of pre-configured PIN/Passwords. Internally, the scheme exploits two behavioral biometric traits, i.e., touch-timing-differences of the entered strokes and the hand-movement gesture recorded during the random text entry, to authenticate users. And, for the entire user session, the scheme continuously authenticates the user by computing the risk-score every time the user initiates a sensitive activity. If the risk-score is higher than the predefined threshold, the current user session terminates. Afterward, the scheme requests the user to re-authenticate. Thus, our scheme serves three main objectives: Firstly, it offers users the flexibility to enter an 8 − digit random alphanumeric text as their secret enhancing the usability of PIN/password-based schemes. Secondly, it strengthens the security of PIN/password-based schemes as verification decision is not binary, and mimicking the invisible touch-timings and hand-movements simultaneously, could be extremely difficult as our security analysis determined. Lastly, the scheme does not require any dedicated device (e.g., a smart token for OTP generation) for 2-factor authentication. The results obtained on 11,400 user-samples (collected by 3 days in-the-wild testing) and user-experience responses (received from the Software Usability Scale4 survey) of 95 testers demonstrate our scheme as an accurate and acceptable user authentication scheme.

HsIrisNet: Histogram Based Iris Recognition to Allay Replay and Template Attack Using Deep Learning Perspective

Iris biometric is a widely deployed tool for biometric based user authentication. Its success has paved path for several security related attacks on this biometric. In this paper, we propose a deep learning perspective to solve two of these attacks—replay attack and database attack simultaneously. The proposed architecture HsIrisNet, a convolutional neural network (CNN), is trained and tested on two publicly available databases Casia-Iris-Interval v4 DB and IIT Delhi DB. The proposed approach HsIrisNet uses histograms of the selective robust regions followed by image upsampling to authenticate the user. These robust regions have been found to be sufficient enough to authenticate the user, enabling non-deterministic approach. The use of these selective regions for authentication enables the system to mitigate replay attack. While, the CNN model does not require saving any biometric data to the database, which mitigates database attack from the system. The comparison of proposed approach with existing state-of-art techniques show better performance of the proposed approach.

Machine learning in cybersecurity: a comprehensive survey

Today’s world is highly network interconnected owing to the pervasiveness of small personal devices (e.g., smartphones) as well as large computing devices or services (e.g., cloud computing or online banking), and thereby each passing minute millions of data bytes are being generated, processed, exchanged, shared, and utilized to yield outcomes in specific applications. Thus, securing the data, machines (devices), and user’s privacy in cyberspace has become an utmost concern for individuals, business organizations, and national governments. In recent years, machine learning (ML) has been widely employed in cybersecurity, for example, intrusion or malware detection and biometric-based user authentication. However, ML algorithms are vulnerable to attacks both in the training and testing phases, which usually leads to remarkable performance decreases and security breaches. Comparatively, limited studies have been conducted to understand the essence and degree of the vulnerabilities of ML techniques against security threats and their defensive mechanisms. It is imperative to systematize recent works related to cybersecurity using ML to seek the attention of researchers, scientists, and engineers. Therefore, in this paper, we provide a comprehensive survey of the works that have been carried out most recently (from 2013 to 2018) on ML in cybersecurity, describing the basics of cyber-attacks and corresponding defenses, the basics of the most commonly used ML algorithms, and proposed ML and data mining schemes for cybersecurity in terms of features, dimensionality reduction, and classification/detection techniques. In this context, this article also provides an overview of adversarial ML, including the security characteristics of deep learning methods. Finally, open issues and challenges in cybersecurity are highlighted and potential future research directions are discussed.

On the design of biometric-based user authentication protocol in smart city environment

Among the security services, like authentication, access control, key management and intrusion detection, user authentication is very much needed for a smart city environment because an external authorized user may require the real time data to be accessed directly from the deployed Internet of Things (IoT) enabled smart devices. Using the established session key between the user and an access smart device though mutual authentication and key agreement process, the real time data can be securely accessed. To deal with this issue, we propose a new user authentication scheme in smart city environment using three factors of a legal registered user (mobile device, password and biometrics). The proposed scheme is shown to be robust against a number of potential attacks needed in an IoT-based smart city deployment. The simulation study for formal security verification using the widely-accepted “Automated Validation of Internet Security Protocols and Applications (AVISPA)” tool demonstrates that the proposed scheme is also secure. Furthermore, experiments on various cryptographic primitives have been carried out using “MIRACL Cryptographic SDK: Multiprecision Integer and Rational Arithmetic Cryptographic Library” under both server and Raspberry PI 3 settings. Finally, a comprehensive comparative analysis shows the effectiveness and better security of the proposed scheme as compared with other state of art user authentication schemes.

Freely typed keystroke dynamics-based user authentication for mobile devices based on heterogeneous features

Keystroke dynamics-based authentication (KDA) is one of the human behavioral biometric-based user authentication methods based on the unique typing pattern of a person. Previous KDA studies on mobile devices primarily focused on fixed-length text-based KDA, such as passwords and personal identification numbers. This can strengthen the login system and prevent abnormal usage of impostors based on certain attack methods, such as shoulder surfing and smudge attacks. However, this method possesses a limitation that continuous monitoring is not possible after login. To solve this problem, KDA based on freely typed text was studied; however, there are only a few studies on this technique. Further, the performance authentication based on these studies is insufficient for a real-world implementation. In this paper, we propose a novel freely typed text-based KDA method for mobile devices named FACT, i.e., user authentication on mobile devices based on free text, accelerator, coordinate, and time. We collected data from three different smartphone sensors while typing in two languages (English and Korean), and 17 variables were extracted for a set of keystroke data. A total of six authentication methods were employed and the proposed FACT yielded an equal error rate lower than 1% with only one reference keystroke set; moreover, it demonstrated a perfect protection capability while using Korean when more than four reference keystroke sets were used. To contribute to the research and industrial community, we have publicized our collected keystroke dataset so that anyone who conducts a KDA study or develops a KDA-related mobile service can use the dataset without any restrictions.

VocalLock

Recent years have witnessed the surge of biometric-based user authentication for mobile devices due to its promising security and convenience. As a natural and widely-existed behavior, human speaking has been exploited for user authentication. Existing voice-based user authentication explores the unique characteristics from either the voiceprint or mouth movements, which is vulnerable to replay attacks and mimic attacks. During speaking, the vocal tract, including the static shape and dynamic movements, also exhibits the individual uniqueness, and they are hardly eavesdropped and imitated by adversaries. Hence, our work aims to employ the individual uniqueness of vocal tract to realize user authentication on mobile devices. Moreover, most voice-based user authentications are passphrase-dependent, which significantly degrade the user experience. Thus, such user authentications are pressed to be implemented in a passphrase-independent manner while being able to resist various attacks. In this paper, we propose a user authentication system, VocalLock, which senses the whole vocal tract during speaking to identify different individuals in a passphrase-independent manner on smartphones leveraging acoustic signals. VocalLock first utilizes FMCW on acoustic signals to characterize both the static shape and dynamic movements of the vocal tract during speaking, and then constructs a passphrase-independent user authentication model based on the unique characteristics of vocal tract through GMM-UBM. The proposed VocalLock can resist various spoofing attacks, while achieving a satisfactory user experience. Extensive experiments in real environments demonstrate VocalLock can accurately authenticate user identity in a passphrase-independent manner and successfully resist various attacks.