Unobtrusive Mutual Mobile Authentication with Biometrics and Mobile Device Motion

Rainhard Dieter Findling

Unobtrusive Mutual Mobile Authentication with Biometrics and Mobile Device Motion

Rainhard Dieter Findling

Publikation: Typen von Abschlussarbeiten › Dissertation

Abstract

Mit modernen Mobilgeräten ist Benutzerauthentifizierung ein integraler Bestandteil zum Schutz von Daten auf Mobilgeräten vor unbefugtem, physikalischen Zugriff Dritter geworden. Herausforderungen mobiler Benutzerauthentifizierung umfassen kognitive Belastung (Merken von Geheimnissen), umständliche Eingabe (kleine Benutzerschnittstellen, wenig haptisches Rückmeldung) sowie eine höhere Nutzungsfrequenz von Mobilgeräten bei reduzierter Dauer pro Nutzung. Biometrien können hierbei verbesserte Anwendbarkeit ermöglichen, setzen Benutzer aber auch höheren Risiken hinsichtlich Diebstahl oder ungewollter Veröffentlichung von Biometrien aus. Integrierte Smartcards wiederum können zum Schutz von mobilen Biometrien verwendetet werden, gehen aber mit eingeschränkter Rechenleistung für Erkennungsverfahren einher. Des Weiteren authentifizieren sich Mobilgeräte üblicherweise nicht gegenüber ihren Benutzern, was sogenannte Hardware Phishing Attacks ermöglicht (bei diesen authentifizieren sich Benutzer unwissentlich gegenüber identisch aussehenden aber bösartigen Phishing-Geräten). Die vorliegende Dissertation behandelt mobile Authentifizierungsverfahren für verschiedene Anwendungsszenarien unter sicherer Verwendung von Biometrien und integrierten Sensoren. Es wird eine generische, biometrische Authentifizierung unter Verwendung von Smartcards vorgestellt, welche Authentifizierungsmodelle und biometrische Eigenschaften vorab vereinfacht um deren Verwendung auf Smartcards zu ermöglichen. Des Weiteren wird ein Token-basierendes Authentifizierungsverfahren behandelt, welches durch kurzes gemeinsames Schütteln zweier Mobilgeräte den Authentifizierungszustand eines Geräts sicher auf das andere überträgt. Abschließend wird ein Verfahren zur Authentifizierung von Mobilgeräten gegenüber ihren Benutzern vorgestellt. Bei diesem übertragen Mobilgeräte unter Verwendung eines Vibrationscodes Informationen zu Benutzern – z.B. zeitgleich während sich Benutzer gegenüber dem Gerät authentifizieren. Alle Ansätze werden mit öffentlich verfügbaren Datensätzen evaluiert und zeigen Fehlerraten zwischen 0,2 und 0,02 sowie eine Dauer im Bereich von 1-2 sec auf. Diese Ergebnisse unterstreichen die grundlegende Anwendbarkeit der Ansätze und zeigen gleichzeitig den verbleibenden Spielraum für weitere zukünftige Verbesserungen mobiler Authentifizierungsverfahren auf – u.a. durch Verwendung mobiler Biometrien sowie integrierter Sensoren.

Originalsprache	Englisch
Publikationsstatus	Veröffentlicht - 2017

Zitieren

@phdthesis{8a7291a2f90f436cb5bf1ba9f4e1fc83,

title = "Unobtrusive Mutual Mobile Authentication with Biometrics and Mobile Device Motion",

abstract = "Authentication is an integral part of protecting data on modern mobile devices from unauthorized physical access of third parties. However, it faces different challenges to suit users{\textquoteright} needs. On the one hand classic authentication approaches like PIN or password are obtrusive especially on mobile devices. They impose cognitive load on users and their input on mobile devices is cumbersome due to small user interfaces and limited haptic feedback. This is further intensified by mobile devices being used more frequently but for shorter durations than classic computers. On the other hand biometrics can provide for less obtrusive authentication. However, disclosure of biometric data to third parties can have significant impact as they cannot be changed as easily as PINs or passwords. To avert this additional risk, embedded smart cards (SCs) can be used to process and store biometric data. As those are computationally limited this often leads to feature transformations and matching procedures also being limited. In addition, in contrast to users authenticating to mobile devices, devices usually do not authenticate to users. This enables hardware phishing attacks (users unwittingly authenticating to an identically looking but malicious phishing device). This dissertation investigates unobtrusive mobile authentication for diverse situations in which authentication can be required. It thereby focuses on authentication approaches that utilize mobile biometrics and embedded sensors. We investigate generic biometric match-on-card (MOC) authentication that combines offline machine learning with simplification of features and authentication models to enable their usage on SCs. As the approach is generic it can be applied to different biometrics – demonstrated with gait and face biometrics – which can facilitate the transition of further mobile biometrics to using MOC techniques. We further investigate mobile token authentication to transfer the authentication state from an unlocked device (e.g. wristwatch) to a locked one (e.g. phone) by briefly shaking both devices conjointly. As shaking patterns are difficult to forge it is difficult for attackers to perform authentication when they do not have both devices under their control. We also investigate mobile device-to-user authentication as countermeasure to hardware phishing attacks and let devices communicate an authentication secret to users with vibration patterns. We evaluate our approach using publicly available data, which reveals authentication durations around 1-2 s and error rates between 0.2 and 0.02. This indicates both that our approach is feasible and that room remains for further improving unobtrusive mobile authentication, e.g. with additional approaches utilizing biometrics and sensors on mobile devices.",

author = "Findling, {Rainhard Dieter}",

year = "2017",

language = "English",

}

TY - BOOK

T1 - Unobtrusive Mutual Mobile Authentication with Biometrics and Mobile Device Motion

AU - Findling, Rainhard Dieter

PY - 2017

Y1 - 2017

N2 - Authentication is an integral part of protecting data on modern mobile devices from unauthorized physical access of third parties. However, it faces different challenges to suit users’ needs. On the one hand classic authentication approaches like PIN or password are obtrusive especially on mobile devices. They impose cognitive load on users and their input on mobile devices is cumbersome due to small user interfaces and limited haptic feedback. This is further intensified by mobile devices being used more frequently but for shorter durations than classic computers. On the other hand biometrics can provide for less obtrusive authentication. However, disclosure of biometric data to third parties can have significant impact as they cannot be changed as easily as PINs or passwords. To avert this additional risk, embedded smart cards (SCs) can be used to process and store biometric data. As those are computationally limited this often leads to feature transformations and matching procedures also being limited. In addition, in contrast to users authenticating to mobile devices, devices usually do not authenticate to users. This enables hardware phishing attacks (users unwittingly authenticating to an identically looking but malicious phishing device). This dissertation investigates unobtrusive mobile authentication for diverse situations in which authentication can be required. It thereby focuses on authentication approaches that utilize mobile biometrics and embedded sensors. We investigate generic biometric match-on-card (MOC) authentication that combines offline machine learning with simplification of features and authentication models to enable their usage on SCs. As the approach is generic it can be applied to different biometrics – demonstrated with gait and face biometrics – which can facilitate the transition of further mobile biometrics to using MOC techniques. We further investigate mobile token authentication to transfer the authentication state from an unlocked device (e.g. wristwatch) to a locked one (e.g. phone) by briefly shaking both devices conjointly. As shaking patterns are difficult to forge it is difficult for attackers to perform authentication when they do not have both devices under their control. We also investigate mobile device-to-user authentication as countermeasure to hardware phishing attacks and let devices communicate an authentication secret to users with vibration patterns. We evaluate our approach using publicly available data, which reveals authentication durations around 1-2 s and error rates between 0.2 and 0.02. This indicates both that our approach is feasible and that room remains for further improving unobtrusive mobile authentication, e.g. with additional approaches utilizing biometrics and sensors on mobile devices.

AB - Authentication is an integral part of protecting data on modern mobile devices from unauthorized physical access of third parties. However, it faces different challenges to suit users’ needs. On the one hand classic authentication approaches like PIN or password are obtrusive especially on mobile devices. They impose cognitive load on users and their input on mobile devices is cumbersome due to small user interfaces and limited haptic feedback. This is further intensified by mobile devices being used more frequently but for shorter durations than classic computers. On the other hand biometrics can provide for less obtrusive authentication. However, disclosure of biometric data to third parties can have significant impact as they cannot be changed as easily as PINs or passwords. To avert this additional risk, embedded smart cards (SCs) can be used to process and store biometric data. As those are computationally limited this often leads to feature transformations and matching procedures also being limited. In addition, in contrast to users authenticating to mobile devices, devices usually do not authenticate to users. This enables hardware phishing attacks (users unwittingly authenticating to an identically looking but malicious phishing device). This dissertation investigates unobtrusive mobile authentication for diverse situations in which authentication can be required. It thereby focuses on authentication approaches that utilize mobile biometrics and embedded sensors. We investigate generic biometric match-on-card (MOC) authentication that combines offline machine learning with simplification of features and authentication models to enable their usage on SCs. As the approach is generic it can be applied to different biometrics – demonstrated with gait and face biometrics – which can facilitate the transition of further mobile biometrics to using MOC techniques. We further investigate mobile token authentication to transfer the authentication state from an unlocked device (e.g. wristwatch) to a locked one (e.g. phone) by briefly shaking both devices conjointly. As shaking patterns are difficult to forge it is difficult for attackers to perform authentication when they do not have both devices under their control. We also investigate mobile device-to-user authentication as countermeasure to hardware phishing attacks and let devices communicate an authentication secret to users with vibration patterns. We evaluate our approach using publicly available data, which reveals authentication durations around 1-2 s and error rates between 0.2 and 0.02. This indicates both that our approach is feasible and that room remains for further improving unobtrusive mobile authentication, e.g. with additional approaches utilizing biometrics and sensors on mobile devices.

M3 - Doctoral Thesis

ER -

Unobtrusive Mutual Mobile Authentication with Biometrics and Mobile Device Motion

Abstract

Fingerprint

Zitieren