Continuous Authentication Method Research Articles

Multi-motion sensor behavior based continuous authentication on smartphones using gated two-tower transformer fusion networks

With continuous authentication, smartphones can constantly calculate authentication scores to verify a user's identity while interacting with the smartphones after logging in. Among various behavioral biometrics based continuous authentication methods, motion dynamics biometrics based methods draw a lot of attention, which relies on potential differences in signals from smartphone built-in motion sensors to provide an implicit and secure authentication. However, existing motion dynamics based methods not only fail to model correlations between motion sensors with multiple channels but also ignore temporal patterns contained in each channel. In this paper, we develop a two-tower neural networks based continuous authentication system TNNAuth based on the built-in multi-motion sensors on smartphones. Specifically, TNNAuth divides the raw multi-motion sensor data into channel and temporal stream data, and proposes a gated two-tower transformer fusion network to capture both time-over-channel and channel-over-time motion patterns. To evaluate TNNAuth, we collect a large-scale multi-motion sensor dataset in the unconstrained real life. Extensive experiments demonstrate that TNNAuth can provide the lowest authentication error rate, with a false-acceptance rate of 8.3% and a false-rejection rate of 9.4%.

A novel continuous authentication method using biometrics for IOT devices

In this paper, we examine continuous authentication for IoT devices using real-time biometrics of a person's electrocardiogram (ECG) and electromyography (EMG). ECG is mainly used as a biometric identifier because it has specific features such as mathematical, morphological, and wavelet characteristics. EMG is a bio-signal defining a hand gesture of a person. Our authentication system would require no human interaction as it will have a continuous authentication schema. As soon as the user leaves a specific perimeter, the session will be killed by the system. In this paper, we propose a challenging and integrated methodology for developing, prototyping, and evaluating a continuous authentication scheme to ensure that currently insecure IoT networks are improved to have a high level of security with two layers of biometric security with continuous authentication to perform authentication in an automated manner. We used the dataset from PhysioNet for ECG, which contains samples of around 12 K for 298 people. We also used the EMG dataset available on the geostatic python library containing 150 K samples. In this experiment, we concluded that it is viable to use our continuous authentication for IoT devices with the lowest performance consumption and power consumption. The experimentation also demonstrates that the training model on two bio-signals helps obtain higher accuracy on continuous authentication within an average of 99.6%-99.99%. Our authentication schema can be implemented and integrated on any IoT device with having at least one wireless frequency that can receive and send a signal to the sender/authenticator.

MAUTH: Continuous User Authentication Based on Subtle Intrinsic Muscular Tremors

Continuous authentication is viewed to be increasingly important for mobile devices, which store a wide range of private data and sensitive information of users. Traditional continuous authentication methods need user inputs (e.g. typing, sliding). In this work, we present MAUTH, a zero-effect continuous authentication scheme for mobile devices. With the built-in motion sensors on commercial off-the-shelf (COTS) devices, MAUTH can continuously extract, classify and verify the unique tremor features of users on how their body intrinsically shakes during the normal use of such devices. As a result, it is extremely difficult if not impossible to reproduce the same set of tremors as individuals differ in their muscle development. We implement MAUTH as a software on Android-based smartphones, which demonstrates that MAUTH is light-weight and unobtrusive to its users. We conduct extensive real-world experiments and trace-driven simulations in controlled and uncontrolled environments on 21 volunteers. The results show that MAUTH is difficult to counterfeit and achieves a low average false positive rate (FPR) of 6.73% under real-world spoofing attacks. Moreover, MAUTH is comfortable to use and can achieve a low average false negative rate (FNR) of 2.2% during uncontrolled and continuous usage of devices, leveraging isolation-forest-based classifiers trained with only 40 training samples.

AI-based user authentication reinforcement by continuous extraction of behavioral interaction features

In this work, we conduct an experiment to analyze the feasibility of a continuous authentication method based on the monitorization of the users’ activity to verify their identities through specific user profiles modeled via Artificial Intelligence techniques. In order to conduct the experiment, a custom application was developed to gather user records in a guided scenario where some predefined actions must be completed. This dataset has been anonymized and will be available to the community. Additionally, a public dataset was also used for benchmarking purposes so that our techniques could be validated in a non-guided scenario. Such data were processed to extract a number of key features that could be used to train three different Artificial Intelligence techniques: Support Vector Machines, Multi-Layer Perceptrons, and a Deep Learning approach. These techniques demonstrated to perform well in both scenarios, being able to authenticate users in an effective manner. Finally, a rejection test was conducted, and a continuous authentication system was proposed and tested using weighted sliding windows, so that an impostor could be detected in a real environment when a legitimate user session is hijacked.

A Lightweight Privacy-Aware Continuous Authentication Protocol-PACA

As many vulnerabilities of one-time authentication systems have already been uncovered, there is a growing need and trend to adopt continuous authentication systems. Biometrics provides an excellent means for periodic verification of the authenticated users without breaking the continuity of a session. Nevertheless, as attacks to computing systems increase, biometric systems demand more user information in their operations, yielding privacy issues for users in biometric-based continuous authentication systems. However, the current state-of-the-art privacy technologies are not viable or costly for the continuous authentication systems, which require periodic real-time verification. In this article, we introduce a novel, lightweight, <underline>p</underline>rivacy-<underline>a</underline>ware, and secure <underline>c</underline>ontinuous <underline>a</underline>uthentication protocol called PACA. PACA is initiated through a password-based key exchange (PAKE) mechanism, and it continuously authenticates users based on their biometrics in a privacy-aware manner. Then, we design an actual continuous user authentication system under the proposed protocol. In this concrete system, we utilize a privacy-aware template matching technique and a wearable-assisted keystroke dynamics-based continuous authentication method. This provides privacy guarantees without relying on any trusted third party while allowing the comparison of noisy user inputs (due to biometric data) and yielding an efficient and lightweight protocol. Finally, we implement our system on an Apple smartwatch and perform experiments with real user data to evaluate the accuracy and resource consumption of our concrete system.

A symbolic attribute-based access control model for data security in the cloud

There have been several attempts made in literature to develop access control techniques to stem data security problems. Many of these techniques had been found to have one deficiency or other. Hence, this study developed a Symbolic Attribute-Based Access Control (SABAC) system for data security in the cloud service environment. SABAC system was implemented by developing Hash-tag Symbol Authentication (HSA) algorithm using the Message Digest-5 encryption. SABAC utilizes a 3-Tier continuous authentication method by combining the use of username and password, HSA code, and real-time image monitoring and verification. HSA code is generated by combining 5-tuple user attributes and the string generated from the user’s image using Obfuscation Technique. The concatenated string is converted to hexadecimal which serves as input to MD5 to produces a unique HSA code. SABAC was evaluated using three major security metrics of confidentiality, integrity, and avail-ability. The result of security metrics tests showed a confidence level of 99.993%, integrity threshold of 99.998%, and availability throughput of 150 users/second. This implies that SABAC is highly efficient for cloud data security. It shows that hackers would find it impossible to match any fake identity with valid HSA in the database. The study concluded that SABAC could be used for access control in a cloud environment for assuring data security. It was recommended that the SABAC system should be adopted by Cloud Solution Providers and Security Specialists.

Multimodal Continuous User Authentication on Mobile Devices via Interaction Patterns

Behavior‐based continuous authentication is an increasingly popular methodology that utilizes behavior modeling and sensing for authentication and account access authorization. As an appearing behavioral biometric, user interaction patterns with mobile devices focus on verifying their identity in terms of their features or operating styles while interacting with devices. However, unimodal continuous authentication schemes, which are on the basis of a single source of interaction information, can only deal with a particular action or scenario. Hence, multimodal systems should be taken to suit for various environmental conditions especially in circumstances of attacks. In this paper, we propose a multimodal continuous authentication method both based on static interaction patterns and dynamic interaction patterns with mobile devices. Behavioral biometric features, HMHP, which is combined hand motion (HM) and hold posture (HP), are essentially established upon the touch screen and accelerator and capture the variation model of microhand motions and hold patterns generated in both dynamic and static scenes. By combining the features of HM and HP, the fusion feature HMHP achieves 97% accuracy with a 3.49% equal error rate.

GaitCode: Gait-based continuous authentication using multimodal learning and wearable sensors

The ever-growing threats of security and privacy loss from unauthorized access to mobile devices have led to the development of various biometric authentication methods for easier and safer data access. Gait-based authentication is a popular biometric authentication as it utilizes the unique patterns of human locomotion and it requires little cooperation from the user. Existing gait-based biometric authentication methods however suffer from degraded performance when using mobile devices such as smart phones as the sensing device, due to multiple reasons, such as increased accelerometer noise, sensor orientation and positioning, and noise from body movements not related to gait. To address these drawbacks, some researchers have adopted methods that fuse information from multiple accelerometer sensors mounted on the human body at different locations. In this work we present a novel gait-based continuous authentication method by applying multimodal learning on jointly recorded accelerometer and ground contact force data from smart wearable devices. Gait cycles are extracted as a basic authentication element, that can continuously authenticate a user. We use a network of auto-encoders with early or late sensor fusion for feature extraction and SVM and softmax for classification. The effectiveness of the proposed approach has been demonstrated through extensive experiments on datasets collected from two case studies, one with commercial off-the-shelf smart socks and the other with a medical-grade research prototype of smart shoes. The evaluation shows that the proposed approach can achieve a very low Equal Error Rate of 0.01% and 0.16% for identification with smart socks and smart shoes respectively, and a False Acceptance Rate of 0.54%–1.96% for leave-one-out authentication.

A conversation with Tempestt Neal

Ubiquity's senior editor Dr. Bushra Anjum chats with Dr. Tempestt Neal to discuss her work to improve access control on mobile devices, specifically developing continuous authentication methods.

Authentication of Remote IoT Users Based on Deeper Gait Analysis of Sensor Data

In IoT based systems, authentication of users and devices is a major challenge where the traditional authentication mechanisms such as login-password are no longer supportable. It requires continuous authentication methods to ensure authenticity of the users and devices specifically for long sessions. The authentication through the IoT-Sensors based data has already gained the attention of a considerable number of researchers as it does not require direct involvement of the users and provide an extra layer of security and user privacy. Due to the instability of IoT-Sensor data, the authentication techniques need to extract a large number of features to produce high-accurate results. Moreover, the limited capabilities of computation, communication, storage, and the small battery power of IoT devices further makes its implementation hard. In this paper, we have introduced a user authentication framework for remote IoT users based on unique walking patterns to extract gait-related features with minimum data samples and cycle length. For an in-depth analysis of the distinctive features of the sensor-based gait profiles, we have applied an ECG signal processing technique. The proposed approach applies to a diverse range of IoT devices such as cellphones, smartwatches, and wearable sensors. The main contribution of the proposed approach is the deeper gait analysis with the least number of features and data for authentication purposes. We have introduced an authentication algorithm for feature comparison. The machine learning models have been applied to the gait based profiles for validation of the proposed approach. The detailed experimental analysis of different data sets has achieved an accuracy of 94% and an equal error rate (EER) of 6% higher than the existing approaches.

A survey on different continuous authentication systems

There has been significant research in the provision of trustworthy initial login user authentication, however, there is still need for continuous authentication during a user session. Most mobile devices and computer systems authenticate a user only at the initial login session and do not take steps to recognise whether the present user is still the initial authorised user or an imposter pretending to be a valid user. Therefore, a system to check the identity of the user continuously throughout the whole session is necessary. To ensure the authenticity of the user during their whole login session, a continuous user authentication mechanism is required. In this paper, an overview of different continuous authentication methods is presented along with a discussion on the merits and demerits of the available approaches. This paper also discusses the understanding of the emerging necessities and open problems in continuous user authentication system.

A survey on different continuous authentication systems

There has been significant research in the provision of trustworthy initial login user authentication, however, there is still need for continuous authentication during a user session. Most mobile devices and computer systems authenticate a user only at the initial login session and do not take steps to recognise whether the present user is still the initial authorised user or an imposter pretending to be a valid user. Therefore, a system to check the identity of the user continuously throughout the whole session is necessary. To ensure the authenticity of the user during their whole login session, a continuous user authentication mechanism is required. In this paper, an overview of different continuous authentication methods is presented along with a discussion on the merits and demerits of the available approaches. This paper also discusses the understanding of the emerging necessities and open problems in continuous user authentication system.

BehaveSense: Continuous authentication for security-sensitive mobile apps using behavioral biometrics

With the emergence of smartphones as an essential part of our daily lives, continuous authentication becomes an urgent need which could efficiently protect user security and privacy. However, only a small percentage of apps contain sensitive data. To save energy and protect user security, we propose BehaveSense, an accurate and efficient continuous authentication method for security-sensitive mobile apps using touch-based behavioral biometrics. By exploring four different types of touch operations, we train the owner model using One-Class SVM (OCSVM) and isolation forest (iForest), and calculate the accuracy of each type with the model. Afterwards, we calculate the confidence level of each type using the Bayesian theorem. Finally, we obtain the accuracy of a touch operation sequence with an improved expectedprob algorithm. To validate the effectiveness of the proposed method, we conduct a series of experiments. We collect the WeChat app data of 45 volunteers during two weeks. Experimental results show that our method can recognize user identity efficiently. Specifically, our method achieves average accuracy of approaching 95.85% for touch operation sequence, when considering 9 touch operations. Our method is very promising to authenticate user.

스마트 기기 잠금을 위한 상황인지 위험도기반의 지속인증기법

스마트 기기 잠금을 위한 상황인지 위험도기반의 지속인증기법

Continuous User Authentication on Mobile Devices: Recent progress and remaining challenges

Recent developments in sensing and communication technologies have led to an explosion in the use of mobile devices such as smartphones and tablets. With the increase in the use of mobile devices, users must constantly worry about security and privacy, as the loss of a mobile device could compromise personal information. To deal with this problem, continuous authentication systems (also known as active authentication systems) have been proposed, in which users are continuously monitored after initial access to the mobile device. In this article, we provide an overview of different continuous authentication methods on mobile devices. We discuss the merits and drawbacks of the available approaches and identify promising avenues of research in this rapidly evolving field.