UFace: Your Universal Password That No One Can See
UFace: Your Universal Password That No One Can See
复制标题
DOI：
10.1016/j.cose.2017.09.016
复制
发表时间：
2017-10
期刊：
影响因子：
--
通讯作者：
Nicholas Hilbert;C. Jensen;D. Lin;Wei Jiang
中科院分区：
文献类型：
--
作者：
Nicholas Hilbert;C. Jensen;D. Lin;Wei Jiang
由于易于使用，面部身份验证可能是一种很有前途的方式，可以取代难以记住的密码来访问web服务。然而，要使面部身份验证适用于web服务，仍有几个关键的安全和隐私挑战尚未解决。首先，现有的认证服务器通常会收集用户的面部图像明文进行认证。如果服务器被攻破，攻击者将获得用户的面部图像，并可以轻松地在使用面部身份验证的任何其他应用程序中冒充用户。其次，也很难阻止攻击者利用社交网站上发布的面部图像来冒充真实用户。在本文中，我们通过提出一种称为UFace的新型安全人脸认证系统来解决这两个问题。UFace使用特殊的特写面部图像（无法在网上找到）进行身份验证。为了进一步保证这些特写图片的保密性，UFace保证这些图片只存储在用户端，服务器端没有这些图片的明文。人脸认证通过两个协同认证服务器安全地进行。UFace通过Android应用程序和多个服务器端程序实现，然后在真实环境中进行评估。实验结果表明，该系统可以在几秒内准确地对用户进行身份验证。
Due to the ease of use, face authentication could be a promising way to replace hard-to-remember passwords to access web services. However, to make face authentication suitable for web services, there are still several critical security and privacy challenges unaddressed. First, the existing authentication servers typically collect the plaintext of users' facial images in order to conduct authentication. If the servers are compromised, the attackers would obtain the users' facial images and can easily impersonate the users in any other applications that use face authentication. Second, it is also hard to prevent attackers from using facial images published in social network sites to impersonate the true user. In this paper, we conquered these two issues by proposing a novel secure face authentication system, called UFace. UFace uses special close-up facial images (which cannot be found online) for authentication. To further ensure the confidentiality of these close-up images, UFace guarantees that these images are only stored at user side and the servers have not any plaintext of these images. The face authentication is conducted securely with two collaborative authentication servers. UFace was implemented through both an Android application and multiple server side programs which were then evaluated in a real setting. The experimental results demonstrate that the UFace system can accurately authenticate users within a few seconds.