TWC: Small: Collaborative: Towards Energy-Efficient Privacy-Preserving Active Authentication of Smartphone Users

常见的智能手机身份验证机制，如PIN、图形密码和指纹扫描，提供的安全性有限。它们相对容易被猜测或欺骗，当用户登录后智能手机被捕获时，它们是无效的。多模式主动身份验证通过频繁且不引人注意地通过触摸屏交互、手部运动、步态、语音和电话位置等行为生物识别信号对用户进行身份验证，从而解决了这些挑战。然而，这些技术带来了严重的隐私和安全问题，因为用于身份验证的行为信号代表个人可识别数据，并且通常会暴露用户活动、健康和位置等私人信息。由于智能手机很容易丢失或被盗，因此保护在这些设备上收集和处理的所有敏感行为信息至关重要。保护行为数据的一种方法是通过隐私保护协议执行设备外身份验证。然而，我们的实验表明，使用最先进的技术实现这些协议所需的能量高得不可持续，并导致智能手机电池很快耗尽。这项研究通过设计新的技术来显著降低智能手机上加密身份验证协议的能源成本，从而推动了保护隐私的主动身份验证技术的发展。此外，这项研究还考虑了表明用户已失去智能手机的信号，以便仅在必要时才触发用户身份验证。该项目的重点与现有的技术和协议形成鲜明对比，现有技术和协议在很大程度上与能源消耗模式和用户在身份验证后拥有智能手机的情况无关。该项目的成果是一套新的加密技术和拥有感知协议，能够对智能手机用户进行安全、节能的主动身份验证。这些加密技术通过重塑各个协议组件以考虑到现代智能手机不可或缺的复杂能源权衡和网络异构性，从而提高了保护隐私的主动身份验证的技术水平。最后，该项目将专注于新技术，将与主动身份验证相关的计算从智能手机安全地卸载到(可能不受信任的)云，进一步减少身份验证的能源消耗。因此，从能源和性能的角度来看，拟议的研究将使保护隐私的主动身份验证在智能手机上切实可行。

Common smartphone authentication mechanisms such as PINs, graphical passwords, and fingerprint scans offer limited security. They are relatively easy to guess or spoof, and are ineffective when the smartphone is captured after the user has logged in. Multi-modal active authentication addresses these challenges by frequently and unobtrusively authenticating the user via behavioral biometric signals, such as touchscreen interaction, hand movements, gait, voice, and phone location. However, these techniques raise significant privacy and security concerns because the behavioral signals used for authentication represents personal identifiable data, and often expose private information such as user activity, health, and location. Because smartphones can be easily lost or stolen, it is paramount to protect all sensitive behavioral information collected and processed on these devices. One approach for securing behavioral data is to perform off-device authentication via privacy-preserving protocols. However, our experiments show that the energy required to execute these protocols, implemented using state-of-the-art techniques, is unsustainably high, and leads to very quick depletion of the smartphone's battery. This research advances the state of the art of privacy-preserving active authentication by devising new techniques that significantly reduce the energy cost of cryptographic authentication protocols on smartphones. Further, this research takes into account signals that indicate that the user has lost possession of the smartphone, in order to trigger user authentication only when necessary. The focus of this project is in sharp contrast with existing techniques and protocols, which have been largely agnostic to energy consumption patterns and to the user1s possession of the smartphone post-authentication. The outcome of this project is a suite of new cryptographic techniques and possession-aware protocols that enable secure energy-efficient active authentication of smartphone users. These cryptographic techniques advance the state of the art of privacy-preserving active authentication by re-shaping individual protocol components to take into account complex energy tradeoffs and network heterogeneity, integral to modern smartphones. Finally, this project will focus on novel techniques to securely offload computation related to active authentication from the smartphone to a (possibly untrusted) cloud, further reducing the energy footprint of authentication. The proposed research will thus make privacy-preserving active authentication practical on smartphones, from both an energy and performance perspective.