TWC: Small: Collaborative: Spoof-Resistant Smartphone Authentication using Cooperating Wearables

这项研究正在开发一种方法，利用嵌入在手持和可穿戴设备（例如，智能手表、智能眼镜和脑机接口）中的大量传感器，对智能手机进行强大的用户认证。目前的入口点解决方案主要基于弱的静态凭据，例如用于智能手机身份验证的密码或pin，这是不够的，因为一旦这些凭据被泄露（考虑到密码的许多漏洞，这是很有可能的），攻击者就可以不受限制地访问智能手机。从这个角度来看，即使攻击者已经绕过了入口身份验证功能，也有必要不断保护智能手机。本研究旨在通过开发方法来解决这个问题，通过这种方法，从一个或多个可穿戴设备中提取的线索将与从手机本身提取的线索结合使用，以连续且不显眼地验证用户的真实性。除了提高可穿戴设备如何帮助提高智能手机安全性的知识外，该研究还将产生许多其他更广泛的影响，包括指导本科生，扩展到高中和K-12学生和少数民族，以及通过与制造商和工业联盟合作进行技术转让。这项研究的主要论点是，鉴于配备传感器和可穿戴计算的兴起，在许多情况下可能会有大量的识别线索，因此可以利用这些线索来构建用户友好和防欺骗的智能手机身份验证系统。最重要的方法是，在适用的情况下，不仅捕捉显性用户交互（基于触摸屏传感器），还捕捉基于大量智能手机机载传感器和可穿戴设备传感器的隐性用户交互。车载传感器是智能手机本身的惯性（运动和方向）传感器，用于测量用户与手机的隐性交互，特别是手机的运动、倾斜和方向。相比之下，可穿戴传感器是惯性和神经生理传感器，位于“协作”可穿戴设备上，与智能手机“配对”，并测量用户与这些设备的交互，特别是与不同身体部位相关的运动动态和神经生理模式。该项目正在研究如何使用这种多面线索来产生一种智能手机身份验证系统，该系统可以抵御意外错误和故意欺骗攻击。

This research is developing methods that leverage a multitude of sensors embedded in hand-held and wearable devices (e.g., smart watches, smart glasses and brain-computer interfaces) for strong user authentication to smart phones. The current point-of-entry solutions, largely based on weak static credentials, such as passwords or PINs for authentication to smart phones are not sufficient because once such credentials are compromised (which is very likely given the many vulnerabilities of passwords), the attacker may gain unfettered access to the smart phone. In this light, it becomes necessary to constantly protect the smart phone even after the attacker has already bypassed the point-of-entry authentication functionality. This research aims to address this problem by developing methods through which cues extracted from one or more wearable devices will be used in conjunction with cues extracted from the phone itself to continuously and unobtrusively verify the authenticity of the user. In addition to advancing knowledge on how wearable devices can help improve smart phone security, the research will have a number of other broader impacts including, mentoring of undergraduate students, outreach to high school and K-12 students and minority populations, and technology transfer by collaborating with manufacturers and industrial consortia.The principal argument underlying this research is that, given the rise of sensor-equipped and wearable computing, a wide array of identifying cues might be available in many circumstances and can therefore be leveraged to build user-friendly and spoof-resistant smart phone authentication systems. The overarching approach is to not only capture explicit user interactions (based on touch screen sensors) when applicable, but also capture implicit user interactions based on a conglomeration of a multitude of smart phone on-board sensors as well as wearable device sensors. The on-board sensors are inertial (motion and orientation) sensors residing on the smart phone itself and measure users' implicit interactions with the phone, specifically, phone movements, tilts and orientations. The wearable sensors, in contrast, are inertial and neuro-physiological sensors residing on "collaborating" wearable devices, "paired" with the smart phone, and measure user's interactions with those devices, specifically, movement dynamics associated with different body parts, and neuro-physiological patterns. The project is studying how the use of such multi-faceted cues can yield a smart phone authentication system that is robust against accidental errors as well as deliberate spoofing attacks.