POSTER: When and How to Implicitly Authenticate Smartphone Users

doi:10.1145/2660267.2662373

Return

POSTER: When and How to Implicitly Authenticate Smartphone Users

2014-11-03

PRE

Aaron Atwater *

Khan, Hassan

Hengartner, Urs

DOI：10.1145/2660267.2662373

Original

Original request for help

Save

Abstract

En 中文

Possession of modern smartphones is becoming increasingly ubiquitous, and with this rise in usage comes a rise in the amount of sensitive data being stored on them. Despite this, the high-frequency, low-duration nature of the average smartphone session makes passwords or PIN-locks even less usable than in the desktop context. To combat these issues, implicit authentication (IA) schemes can be developed and deployed to smartphones. IA schemes continuously authenticate users by profiling their behaviour using the variety of sensors prevalent on the phones, such as touchscreens and accelerometers. When a non-owner acquires the device and attempts to access sensitive data on it, the IA scheme recognizes the difference in behaviour and automatically ejects the attacker from the system. In particularly sensitive contexts, IA schemes can also be deployed as a secondary defence mechanism on top of explicit authentication, providing layered security in the event of, for example, a shoulder-surfing attack compromising the device's PIN or an operating system vulnerability allowing its bypass. In this work, we evaluate existing proposals for IA schemes using different behavioural feature sets, and evaluate them against real-world data to show when they are (and are not) useful. We have implemented them in an easily extensible open source framework for the Android operating system called Itus, which allows other researchers to iteratively improve on the existing mechanisms for performing IA. Itus performs IA at the app level, which we have shown allows app developers to selectively protect sensitive data while decreasing the impact on battery life and device performance, and at the same time obtaining better detection accuracy for the IA scheme being invoked.

Keywords:

Security

Implicit Authentication

Behavioural Biometrics

AI Summary

Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.