Perform User Authentication Research Articles

Smartwatch User Authentication by Sensing Tapping Rhythms and Using One-Class DBSCAN.

As important sensors in smart sensing systems, smartwatches are becoming more and more popular. Authentication can help protect the security and privacy of users. In addition to the classic authentication methods, behavioral factors can be used as robust measures for this purpose. This study proposes a lightweight authentication method for smartwatches based on edge computing, which identifies users by their tapping rhythms. Based on the DBSCAN clustering algorithm, a new classification method called One-Class DBSCAN is presented. It first seeks core objects and then leverages them to perform user authentication. We conducted extensive experiments on 6110 real data samples collected from more than 600 users. The results show that our method achieved the lowest Equal Error Rate () of only 0.92%, which was lower than those of other state-of-the-art methods. In addition, a statistical method for detecting the security level of a tapping rhythm is proposed. It can prevent users from setting a simple tapping rhythm password, and thus improve the security of smartwatches.

RiskCog: Unobtrusive Real-Time User Authentication on Mobile Devices in the Wild

Recent hardware advances have led to the development and consumerization of mobile devices, which mainly include smartphones and various wearable devices. To protect the privacy of users, various user authentication mechanisms have been proposed. In particular, biometrics has been widely used for multi-factor authentication. However, biometrics-based authentication mechanisms usually require costly sensors deployed on devices, and rely on explicit user input and Internet connection for performing user authentication. In this article, we propose a system, called RiskCog , which can authenticate the ownership of mobile devices unobtrusively and in a real-time manner by adopting a learning-based approach. Unlike previous studies on user authentication, for cross-platform deployment, maximum user privacy protection, and unobtrusive authentication, RiskCog only relies on those widely available and privacy-insensitive motion sensors to capture the data related to the users’ daily device usage. It requires no users’ explicit input and has no requirement on the users’ motion state or the device placement. RiskCog is also usable in the environment without Internet access by performing offline user identity verification. We conduct comprehensive experiments on smartphones and smartwatches, which show that RiskCog can authenticate device users rapidly and with high accuracy.

Partial DCT-based cancelable biometric authentication with security and privacy preservation for IoT applications

Biometric authentication is being vastly used in identity verification for several IoT applications, nowadays. The security and privacy of the biometrics templates used in the authentication process becomes mandatory as it contains rich personal information of the user. Cancelable Biometric System (CBS) is a template securing approach using repeated distortions/transformations at feature/signal level. It is an effective template securing approach which provides non-invertibility, revocability and diversity to the users enrolled with the cancelable template database. The cancelable template database containing cancelable biometric templates of the users is typically stored in a trusted standalone server. To meet the growing demand of IoT applications, cloud computing with provision to store and process even large database, is being largely deployed. However, the security and privacy of the data stored in the cloud is uncertain. In this paper, we have proposed a novel partial DCT-based CBS with privacy and security preservation for providing authentication services in various IoT applications. We have also devised techniques for session key agreement, data encryption and data integrity in the proposed framework to solve the issues of confidentiality, integrity, and availability (CIA) during cancelable template enrolment and authentication. The experimental results and analysis prove that proposed approach performs user authentication with high accuracy and minimal overhead while preserving security and privacy of sensitive cancelable biometric templates.

Secure Key Agreement and Key Protection for Mobile Device User Authentication

As mobile devices ownership becomes more prevalent (e.g., a user owns multiple mobile devices), the capability to offer secure and user friendly authentication becomes increasingly important. A large number of identity-based user authentication mechanisms for the wireless mobile environment have been proposed. However, they are not generally designed for situations where a user’s private key and some other sensitive data can be exposed if his/her mobile device is remotely or physically controlled by an attacker. Threshold secret sharing is one of the solutions to this problem, but it is limited in the requirement that there should exist an honest third-party to hold the complete key after the secret reconstruction process. Therefore, in this paper, we consider the special case that only two devices (i.e., no honest party) at the user’s side jointly perform user authentication with a server, and neither device can successfully complete the authentication process alone. Moreover, the key reconstruction is not needed during authentication so that neither device can hold a complete key. We then analyze the security of the proposed protocol and show that it satisfies all known security requirements in practical applications, particularly the key exposure attack resistance. The performance analysis of the proposed protocol is also presented to demonstrate its practicality.

Securing Consumer IoT in the Smart Home: Architecture, Challenges, and Countermeasures

The consumer Internet of Things (IoT) platforms are gaining high popularity. However, due to the open nature of wireless communications, smart home platforms are facing many new challenges, especially in the aspect of security and privacy. In this article, we first introduce the architecture of current popular smart home platforms and elaborate the functions of each component. Then we discuss the security and privacy challenges arising from these platforms and review the state of the art of the proposed countermeasures. We give a comprehensive survey on several new attacks on the voice interface of smart home platforms, which aim to gain unauthorized access and execute over-privileged behaviors to compromise the user's privacy. To thwart these attacks, we propose a novel voice liveness detection system, which analyzes the wireless signals generated by IoT devices and the received voice samples to perform user authentication. We implement a real-world testbed on Samsung's SmartThings platform to evaluate the performance of the proposed system, and demonstrate its effectiveness.

Multimedia image data processing on smartphone for authentication

The spread of smartphones is rapidly increasing. Such smartphones mainly handle image and video data. In particular, there are many security problems that may occur at this time when there are many accesses to multimedia image data. But most systems use various technologies for user authentication such as identification/password (ID/PW), the certificate, One-Time Password (OTP), fingerprint/iris recognition, etc. When using ID/PW technology, the system is vulnerable, if ID/PW is disclosed to a hacker. The certificate or fingerprint/iris recognition technologies are more secure than ID/PW technology, but they require more cost, and they are complex to build. In this paper, we propose the method for enhancing user authentication. The proposed method improves security at a low cost using the user’s authentication information and the user’s smartphone IMEI information. In particular, IMEI information can be seen to provide a fast right and secure authentication mechanism to perform user authentication of multimedia image processing. In our research method, it is much safer and superior responsiveness than authentication methods using only user ID / Password on smartphones.

Authenticating Users Through Fine-Grained Channel Information

User authentication is the critical first step in detecting identity-based attacks and preventing subsequent malicious attacks. However, the increasingly dynamic mobile environments make it harder to always apply cryptographic-based methods for user authentication due to their infrastructural and key management overhead. Exploiting non-cryptographic based techniques grounded on physical layer properties to perform user authentication appears promising. In this work, the use of channel state information (CSI), which is available from off-the-shelf WiFi devices, to perform fine-grained user authentication is explored. Particularly, a user-authentication framework that can work with both stationary and mobile users is proposed. When the user is stationary, the proposed framework builds a user profile for user authentication that is resilient to the presence of a spoofer. The proposed machine learning based user-authentication techniques can distinguish between two users even when they possess similar signal fingerprints and detect the existence of a spoofer. When the user is mobile, it is proposed to detect the presence of a spoofer by examining the temporal correlation of CSI measurements. Both office building and apartment environments show that the proposed framework can filter out signal outliers and achieve higher authentication accuracy compared with existing approaches using received signal strength (RSS).

Performance Analysis of Motion-Sensor Behavior for User Authentication on Smartphones.

The growing trend of using smartphones as personal computing platforms to access and store private information has stressed the demand for secure and usable authentication mechanisms. This paper investigates the feasibility and applicability of using motion-sensor behavior data for user authentication on smartphones. For each sample of the passcode, sensory data from motion sensors are analyzed to extract descriptive and intensive features for accurate and fine-grained characterization of users’ passcode-input actions. One-class learning methods are applied to the feature space for performing user authentication. Analyses are conducted using data from 48 participants with 129,621 passcode samples across various operational scenarios and different types of smartphones. Extensive experiments are included to examine the efficacy of the proposed approach, which achieves a false-rejection rate of 6.85% and a false-acceptance rate of 5.01%. Additional experiments on usability with respect to passcode length, sensitivity with respect to training sample size, scalability with respect to number of users, and flexibility with respect to screen size were provided to further explore the effectiveness and practicability. The results suggest that sensory data could provide useful authentication information, and this level of performance approaches sufficiency for two-factor authentication on smartphones. Our dataset is publicly available to facilitate future research.

Hardware Accelerator Approach Towards Efficient Biometric Cryptosystems for Network Security

Protecting data and its communication is a critical part of the modern network. The science of protecting data, known as cryptography, uses secret keys to encrypt data in a format that is not easily decipherable. However, most commonly secure logons for a workstation connected to a network use passwords to perform user authentication. These passwords are a weak link in the security chain, and are a common point of attack on cryptography schemes. One alternative to password usage for network security is to use a person’s physical characteristics to verify who the person is and unlock the data correspondingly. This study focuses on the Cambridge biometric cryptosystem, a system for performing user authentication based on a user’s iris data. The implementation of this system expanded from a single-core software-only system to a collaborative system consisting of a single core and a hardware accelerator. The experiment takes place on a Xilinx Zynq-7000 All Programmable SoC. Software implementation is performed on one of the embedded ARM A9 cores while hardware implementation makes use of the programmable logic. Our hardware acceleration produced a speedup of 2.2X while reducing energy usage to 47.5 % of its original value for the combined enrolment and verification process. These results are also compared to a many-core acceleration of the same system, providing an analysis of different acceleration methods.

A Multimodal User Authentication System Using Faces and Gestures.

As a novel approach to perform user authentication, we propose a multimodal biometric system that uses faces and gestures obtained from a single vision sensor. Unlike typical multimodal biometric systems using physical information, the proposed system utilizes gesture video signals combined with facial images. Whereas physical information such as face, fingerprints, and iris is fixed and not changeable, behavioral information such as gestures and signatures can be freely changed by the user, similar to a password. Therefore, it can be a countermeasure when the physical information is exposed. We aim to investigate the potential possibility of using gestures as a signal for biometric system and the robustness of the proposed multimodal user authentication system. Through computational experiments on a public database, we confirm that gesture information can help to improve the authentication performance.

Operation Request Gatekeeper: A software system for remote access control of diagnostic instruments in fusion experiments

Tokamak diagnostic settings are repeatedly modified to meet the changing needs of each experiment. Enabling the remote diagnostic control has significant challenges due to security and efficiency requirements. The Operation Request Gatekeeper (ORG) is a software system that addresses the challenges of remotely but securely submitting modification requests. The ORG provides a framework for screening all the requests before they enter the secure machine zone and are executed by performing user authentication and authorization, grammar validation, and validity checks. A prototype ORG was developed for the ITER CODAC that satisfies their initial requirements for remote request submission and has been tested with remote control of the KSTAR Plasma Control System. This paper describes the software design principles and implementation of ORG as well as worldwide test results.

Embedded access points for trusted data and resources access in HPC systems

Biometric authentication systems represent a valid alternative to the conventional username---password based approach for user authentication. However, authentication systems composed of a biometric reader, a smartcard reader, and a networked workstation which perform user authentication via software algorithms have been found to be vulnerable in two areas: firstly in their communication channels between readers and workstation (communication attacks) and secondly through their processing algorithms and/or matching results overriding (replay attacks, confidentiality and integrity threats related to the stored information of the networked workstation). In this paper, a full hardware access point for HPC environments is proposed. The access point is composed of a fingerprint scanner, a smartcard reader, and a hardware core for fingerprint processing and matching. The hardware processing core can be described as a Handel-C algorithmic-like hardware programming language and prototyped via a Field Programmable Gate Array (FPGA) based board. The known indexes False Acceptance Rate (FAR) and False Rejection Rate (FRR) have been used to test the prototype authentication accuracy. Experimental trials conducted on several fingerprint DBs show that the hardware prototype achieves a working point with FAR=1.07% and FRR=8.33% on a proprietary DB which was acquired via a capacitive scanner, a working point with FAR=0.66% and FRR=6.13% on a proprietary DB which was acquired via an optical scanner, and a working point with FAR=1.52% and FRR=9.64% on the official FVC2002_DB2B database. In the best case scenario (depending on fingerprint image size), the execution time of the proposed recognizer is 183.32 ms.

Efficient mediators with closures for handling dynamic interfaces in an imperative language

Mediators are well-known software components in the construction of distributed systems and applications, with clear advantages when adding functionality to legacy code. However, mediators that must handle dynamic interfaces (i.e. those that may change at run-time such as callback functions) are not easy to build in most imperative languages such as C, due to the many variants implied by the dynamic interfaces. We call this kind of mediators intermediators. We propose a systematic implementation method based on the concept of closures to implement intermediators using the Tempo run-time specializer for C programs. To illustrate this method, we implemented a unified user authentication intermediator for Unix and Windows 2000 called GINA-IM. GINA-IM gets the password entries from a Unix NIS server and performs user authentication based on the Graphical Identification and Authentication (GINA) model of Windows 2000. The code of GINA-IM is a quarter of the code size of a conventional component written without our tools. GINA-IM is in production use at authors' university by two thousands of freshmen in class and several thousands of students daily.

A scheme for providing security services in ISO-OSI computer network architecture

In a draft addendum of the Open Systems Interconnection Computer Network Reference Model Architecture, the Transport Layer provides a set of security services for user authentication and data confidentiality. This requires the generation and distribution of a new session key between source and destination host systems. But for geographically distributed end-user host systems, communication with a centralized Key Distribution Center for session key generation and distribution takes a considerable amount of time. Therefore, to reduce this time, a scheme is proposed in this paper to minimize the communication tasks involved between the KDC and end-user systems. In this scheme, the development of an independent Security Service Module at end-user host systems is proposed for providing the session key generation and distribution and other security-related services. Also, a three-sublayer structure of the Security Service Module is presented to perform user authentication and data confidentiality services within the OSI Transport Layer.