CSR: Small: Behavior Based User Authentication for Mobile Devices

配备触摸屏的移动设备具有越来越丰富的功能、增强的计算能力和更大的存储容量。这些设备通常包含私人信息，如个人照片、电子邮件，甚至公司数据。因此，为触摸屏设备提供安全便捷的用户认证机制至关重要。然而，广泛使用的基于密码/PIN/图案的解决方案容易受到肩部冲浪（因为移动设备经常在公共场所使用，经常有意或无意地发生肩部冲浪）和涂抹攻击（因为手指在触摸屏上留下的油渣可以被骗子识别），有时用户在走路或开车时不方便输入。这个项目的目标是为触摸屏设备开发一种基于行为的用户认证方法。与仅仅根据用户输入的内容（如密码/PIN/模式）对用户进行身份验证不同，行为身份验证基于用户提供输入的方式。具体来说，用户首先被要求在触摸屏上执行某些动作，例如手势/签名，然后从动作中提取行为特征信息（例如速度大小和设备加速度），以基于机器学习技术对用户进行身份验证。该方法背后的直觉是，人们在触摸屏上执行手势和签名的行为是一致和不同的。与目前用于触摸屏设备的用户认证方案相比，所提出的方法明显更难以妥协，因为冒名顶替者几乎不可能通过肩部冲浪或涂抹攻击来复制其他人的手势/签名行为——他们可以看到它，但他们无法做到。本项目将促进对触摸屏设备上基于行为的用户认证的认识和理解。这是一项具有高影响力的潜在变革性研究。如果成功，该项目不仅将为触摸屏设备上基于行为的用户认证提供理论基础，而且还将为该方向的未来研究奠定基础。

Mobile devices equipped with touch screens have increasingly rich functionality, enhanced computing power, and greater storage capacity. These devices often contain private information such as personal photos, emails, and even corporate data. Therefore, it is crucial to have secure yet convenient user authentication mechanisms for touch screen devices. However, the widely used password/PIN/pattern based solutions are susceptible to shoulder surfing (as mobile devices are often used in public settings where shoulder surfing often happens either purposely or inadvertently) and smudge attacks (as oily residues left by fingers on touch screens can be recognized by impostors) and are sometimes inconvenient for users to input when they are walking or driving.The goal of this project is to develop a behavior based user authentication approach for touch screen devices. Rather than authenticating users solely based on what they input (such as a password/PIN/pattern), Behavioral Authentication is based upon how users provide input input. Specifically, a user is first asked to perform certain actions, such as gestures/signatures, on touch screens and then the behavior feature information (such as velocity magnitude and device acceleration) is extracted from the actions to authenticate the user based on machine learning techniques. The intuition behind the proposed approach is that people have consistent and distinguishing behavior of performing gestures and signatures on touch screens. Compared with current user authentication schemes for touch screen devices, the proposed approach is significantly more difficult to compromise because it is nearly impossible for impostors to reproduce the behavior of others doing gestures/signatures through shoulder surfing or smudge attacks - they can see it, but they cannot do it.This project will advance the knowledge and understanding of behavior based user authentication on touch screen devices. This is potentially transformative research with high-impact. If successful, this project will not only yield a theoretical foundation for behavior based user authentication on touch screen devices but also invite future research along this direction.