in Continuous Touch-Based Authentication for Mobile Devices Vincent - - PowerPoint PPT Presentation

▶
in continuous touch based authentication for
SMART_READER_LITE
LIVE PREVIEW

in Continuous Touch-Based Authentication for Mobile Devices Vincent - - PowerPoint PPT Presentation

Oct 19, 2022 313 likes •696 views

At Your Fingertips: Considering Finger Distinctness in Continuous Touch-Based Authentication for Mobile Devices Vincent Sritapan Zaire Ali and Jamie Payton Cyber Security Division Department of Computer Science US Department of Homeland

slide-1
SLIDE 1

At Your Fingertips: Considering Finger Distinctness in Continuous Touch-Based Authentication for Mobile Devices

Zaire Ali and Jamie Payton Department of Computer Science University of North Carolina at Charlotte

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

1

Vincent Sritapan Cyber Security Division US Department of Homeland Security Science and Technology Directorate

slide-2
SLIDE 2

2.6B

Smartphone subscriptions as of 2014 [13]

6.1B

Smartphone subscriptions by 2020 [13] [12]

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

2

Our Personal Assistant

64%

Users use no authentication

[3]

2.6B

Smartphone subscriptions as of 2014 [13]

6.1B

Smartphone subscriptions by 2020 [13]

slide-3
SLIDE 3

Strong Security & Rarely Used

Password 78,074,696

unique password permutations using 4 characters [4] unique password permutations using 5 characters [4]

7,339,040,224

Active Authentication

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

3

No Authentication

No Security

Swipe Pattern PIN

Medium Security

64%

[3]

Of users

[14]

140,704

unique swipe patterns using all 9 nodes [14]

1,624

unique swipe patterns using 4 nodes [14]

1,000,000,000

unique PIN permutations using 9 digits [14]

10,000

unique PIN permutations using 4 digits

slide-4
SLIDE 4

Active Authentication

Single-Factor Authentication (Only Using One Group)

  • Knowledge

– Passwords – PINs – Patterns

  • Possession

– Token – Key Card

  • Inherence

– Retina – Fingerprints

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

4

[14]

Example of Common Weak Swipe Patterns

slide-5
SLIDE 5

Passive Authentication

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

5

Time (ms) X-Coordinate Y-Coordinate Pressure Size Time (ms) X-Coordinate Y-Coordinate Pressure Size 500176 172.9635 626 0.282353 0.282353 504485 258.4167 559.0695 0.298039 0.298039 507079 319.4074 467.0485 0.286275 0.286275 508157 554.0085 611 0.27451 0.27451 509971 175.8468 576.6588 0.258824 0.258824 Collectable Features Gesture on Device Distinct Data

slide-6
SLIDE 6

Passive Authentication

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

6

Black Box Authorized User Training Data Data Collected From Touch Authorized User or Unknown User

slide-7
SLIDE 7

k = 3 k = 6

k-Nearest Neighbor

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

7

Black Box

Pressure Size

Class 1 Class 2

slide-8
SLIDE 8

Support Vector Machines

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

8

Black Box

Pressure Size

Class 1 Class 2

slide-9
SLIDE 9

State of the Art: SVM

Study by Xu et al.

  • Used SVM with Radial

Basis Function (rbf)

  • Accuracy Declined With

More Users

  • Assumed Users Always

Used the Same Style

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

9

All can achieve:+80%

[14]

slide-10
SLIDE 10

Operation Styles

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

10

One handed – 49% Cradled – 36% Two handed – 15%

[10]

slide-11
SLIDE 11

Operation Styles

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

11

One handed – 49% Cradled – 36% Two handed – 15%

[10]

slide-12
SLIDE 12

Motivation

 Does authentication accuracy improve by training with several of a user’s fingers?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

12

slide-13
SLIDE 13

App Development

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

13

slide-14
SLIDE 14

App Development

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

14

slide-15
SLIDE 15

Pilot Study Setup

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

15

  • Online advertisement and snowball

sampling

  • 6 participants (3 male, 3 female)
  • Droid Maxx Devices
  • 5 Days
slide-16
SLIDE 16

Pilot Study Setup

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

16

Time (ms) X-Coordinate Y-Coordinate Pressure Size 500176 172.9635 626 0.282353 0.282353 504485 258.4167 559.0695 0.298039 0.298039 507079 319.4074 467.0485 0.286275 0.286275 508157 554.0085 611 0.27451 0.27451 509971 175.8468 576.6588 0.258824 0.258824 Distinct Data

slide-17
SLIDE 17

Preprocessing

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

17

Gesture on Device

MotionEvent SensorEvent

Time (ms) X-Coordinate Y-Coordinate Pressure Size X-Accelerometer Y-Accelerometer 548476 422 522 0.282353 0.282353 1.474828 5.152322 548514 427.4653 568.3857 0.298039 0.298039 1.474828 5.152322 548525 429 618.5961 0.298039 0.298039 1.474828 5.152322 548541 426.0154 676.2451 0.290196 0.290196 1.474828 5.152322 548557 417.4294 745.6889 0.278431 0.278431 1.474828 5.152322 Data Stored in Vector

slide-18
SLIDE 18

Preprocessing

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

18

Time (ms) X-Coordinate Y-Coordinate Pressure Size X-Accelerometer Y-Accelerometer 548476 422 522 0.282353 0.282353 1.474828 5.152322 548514 427.4653 568.3857 0.298039 0.298039 1.474828 5.152322 548525 429 618.5961 0.298039 0.298039 1.474828 5.152322 548541 426.0154 676.2451 0.290196 0.290196 1.474828 5.152322 548557 417.4294 745.6889 0.278431 0.278431 1.474828 5.152322 Data Stored in Vector

GestureDetector Which Gesture?

e.g. Swipe Left Gesture Data

slide-19
SLIDE 19

Our Approach

  • SVM with Radial Basis

Function (rbf)

  • 10-fold Cross-Validation

to Compute Accuracy

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

19

slide-20
SLIDE 20

Data Analysis

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

20

𝐵𝑑𝑑𝑣𝑠𝑏𝑑𝑧 = 𝐷𝑝𝑠𝑠𝑓𝑑𝑢𝑚𝑧 𝐷𝑚𝑏𝑡𝑡𝑗𝑔𝑗𝑓𝑒 𝑄𝑝𝑗𝑜𝑢𝑡 𝑂𝑣𝑛𝑐𝑓𝑠 𝑝𝑔 𝑈𝑓𝑡𝑢𝑗𝑜𝑕 𝑄𝑝𝑗𝑜𝑢𝑡

slide-21
SLIDE 21

Are the Fingers of an Individual Distinct?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

21

Training Data Testing Data Classification Output

slide-22
SLIDE 22

Are the Fingers of an Individual Distinct?

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Tap Double Tap Long Tap Swipe Right Swipe Left Swipe Up Swipe Down Average Without Accelerometer

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

22

86% 67.05%

slide-23
SLIDE 23

Are the Fingers of an Individual Distinct?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

23

slide-24
SLIDE 24

Are the Fingers of an Individual Distinct?

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Tap Double Tap Long Tap Swipe Right Swipe Left Swipe Up Swipe Down Average Without Accelerometer With Accelerometer

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

24

96.35%

slide-25
SLIDE 25

Are Fingers Distinct?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

25

Training Data Testing Data Classification Output

slide-26
SLIDE 26

Are Fingers Distinct?

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Tap Double Tap Long Tap Swipe Right Swipe Left Swipe Up Swipe Down Average Without Accelerometer With Accelerometer

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

26

83.93% 97.67%

slide-27
SLIDE 27

Should Training Data Include Only One Finger?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

27

Training Data Testing Data Classification Output

slide-28
SLIDE 28

Should Training Data Include Only One Finger?

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Tap Double Tap Long Tap Swipe Average Average Without Accelerometer With Accelerometer

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

28

55.9% 61.2%

slide-29
SLIDE 29

Should Training Data Include Several Fingers?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

29

Training Data Testing Data Classification Output

slide-30
SLIDE 30

Should Training Data Include Several Fingers?

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Tap Double Tap Long Tap Swipe Right Swipe Left Swipe Up Swipe Down Average Without Accelerometer With Accelerometer

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

30

92% 98.42%

slide-31
SLIDE 31

Lessons Learned

  • Active Authentication is Annoying
  • Fingers are Distinct
  • Training Data Should Include Several Fingers

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

31

slide-32
SLIDE 32

Future Work

  • Address potential limitations related to the number of participants in our pilot

study through a more expansive study

  • more users
  • wider range of gestures
  • longer period of time
  • Analyze effects of training data set sizes
  • Latency of real-time classification on mobile devices

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

32

slide-33
SLIDE 33

Thank You!

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

33

This project is the result of funding provided by the Science and Technology Directorate of the United States Department of Homeland Security under contract number D15PC00160. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the funding agency.

slide-34
SLIDE 34

Broad Agency Announcement

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

34

Amendment 21 (HSHQDC-16-R-B0006 A000001) (https://www.fbo.gov/spg/DHS/OCPO/DHS- OCPO/HSHQDC-14-R-B0005/packages.html) http://www.cvent.com/d/wfqtz4 for details and to register. This event is complimentary, however, space is limited. Please note: Registration closes June 7.

slide-35
SLIDE 35

Questions?

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

35

slide-36
SLIDE 36

References

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

36

[1] J. Bonneau, “The science of guessing: Analyzing an anonymized corpus of 70 million passwords,” in Security and Privacy (SP), 2012 IEEE Symposium on, May 2012, pp. 538–552. [2] Y.-L. Chen, W.-C. Ku, Y.-C. Yeh, and D.-M. Liao, “A simple textbased shoulder surfing resistant graphical password scheme,” in Next-Generation Electronics (ISNE), 2013 IEEE International Symposium on, Feb 2013, pp. 161–164. [3] N. Micallef, M. Just, L. Baillie, M. Halvey, and H. G. Kayacik, “Why aren’t users using protection? investigating the usability of smartphone locking,” in Proceedings of the 17th International Conference on Human-Computer Interaction with Mobile Devices and Services, ser. MobileHCI ’15. New York, NY, USA: ACM, 2015, pp. 284–294. [4] S. Gold, “Wireless cracking: there’s an app for that,” Network Security, vol. 2012, no. 5, pp. 10–14, 2012. [5] M. Frank, R. Biedert, E. Ma, I. Martinovic, and D. Song, “Touchalytics: On the applicability of touchscreen input as a behavioral biometric for continuous authentication,” CoRR, vol. abs/1207.6231, 2012. [6] H. Xu, Y. Zhou, and M. R. Lyu, “Towards continuous and passive authentication via touch biometrics: An experimental study on smartphones,” in Symposium On Usable Privacy and Security (SOUPS 2014). Menlo Park, CA: USENIX Association, 2014, pp. 187–198.

slide-37
SLIDE 37

References (Cont’d)

5/26/2016 This work is sponsored by DHS S&T Directorate Contract #D15PC00160

37

[7] L. Li, X. Zhao, and G. Xue, “Unobservable re-authentication for smartphones.” in NDSS. The Internet Society, 2013. [8] T. Feng, J. Yang, Z. Yan, E. M. Tapia, and W. Shi, “Tips: Context-aware implicit user identification using touch screen in uncontrolled environments,” in Proceedings of the 15th Workshop on Mobile Computing Systems and Applications, ser. HotMobile ’14. New York, NY, USA: ACM, 2014, pp. 9:1–9:6. [9] N. Sae-Bae, K. Ahmed, K. Isbister, and N. Memon, “Biometric-rich gestures: A novel approach to authentication on multi- touch devices,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser. CHI ’12. New York, NY, USA: ACM, 2012, pp. 977–986. [10] J. Clark, Designing for touch. New York, N.Y: A Book Apart, 2015. [11] S. Hoober, “How do users really hold mobile devices,” UXmatters, 2013. [12] A. Smith, “U.S. Smartphone Use in 2015," Pew Internet, Tech. Rep., 2015. [13] I. Lunden, “6.1B Smartphone Users Globally By 2020, Overtaking Basic Fixed Phone Subscriptions," TechCrunch, 2015. [14] M. Loge, “Tell Me Who You Are, and I Will Tell You Your Lock Pattern," Passwords, 2015.