TWC: Small: Collaborative: Towards Energy-Efficient Privacy-Preserving Active Authentication of Smartphone Users

TWC：小型：协作：实现智能手机用户的节能隐私保护主动身份验证

• 批准号: 1618300
• 负责人: Gang Zhou
• 金额: $ 20.43万
• 依托单位: College of William and Mary
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-10-01 至 2019-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1618300&HistoricalAwards=false
• 关键词: TWC; Small; Collaborative; Towards; Energy

Common smartphone authentication mechanisms such as PINs, graphical passwords, and fingerprint scans offer limited security. They are relatively easy to guess or spoof, and are ineffective when the smartphone is captured after the user has logged in. Multi-modal active authentication addresses these challenges by frequently and unobtrusively authenticating the user via behavioral biometric signals, such as touchscreen interaction, hand movements, gait, voice, and phone location. However, these techniques raise significant privacy and security concerns because the behavioral signals used for authentication represents personal identifiable data, and often expose private information such as user activity, health, and location. Because smartphones can be easily lost or stolen, it is paramount to protect all sensitive behavioral information collected and processed on these devices. One approach for securing behavioral data is to perform off-device authentication via privacy-preserving protocols. However, our experiments show that the energy required to execute these protocols, implemented using state-of-the-art techniques, is unsustainably high, and leads to very quick depletion of the smartphone's battery. This research advances the state of the art of privacy-preserving active authentication by devising new techniques that significantly reduce the energy cost of cryptographic authentication protocols on smartphones. Further, this research takes into account signals that indicate that the user has lost possession of the smartphone, in order to trigger user authentication only when necessary. The focus of this project is in sharp contrast with existing techniques and protocols, which have been largely agnostic to energy consumption patterns and to the user1s possession of the smartphone post-authentication. The outcome of this project is a suite of new cryptographic techniques and possession-aware protocols that enable secure energy-efficient active authentication of smartphone users. These cryptographic techniques advance the state of the art of privacy-preserving active authentication by re-shaping individual protocol components to take into account complex energy tradeoffs and network heterogeneity, integral to modern smartphones. Finally, this project will focus on novel techniques to securely offload computation related to active authentication from the smartphone to a (possibly untrusted) cloud, further reducing the energy footprint of authentication. The proposed research will thus make privacy-preserving active authentication practical on smartphones, from both an energy and performance perspective.

PIN、图形密码和指纹扫描等常见智能手机身份验证机制提供的安全性有限。它们相对容易被猜测或欺骗，并且在用户登录后捕获智能手机时无效。多模式主动身份验证通过行为生物识别信号（例如触摸屏交互、手部动作、步态、语音和电话位置）频繁且不引人注目地对用户进行身份验证，从而解决了这些挑战。然而，这些技术引起了严重的隐私和安全问题，因为用于身份验证的行为信号代表个人可识别数据，并且经常暴露私人信息，例如用户活动、健康状况和位置。由于智能手机很容易丢失或被盗，因此保护这些设备上收集和处理的所有敏感行为信息至关重要。保护行为数据的一种方法是通过隐私保护协议执行设备外身份验证。然而，我们的实验表明，执行这些使用最先进技术实现的协议所需的能量非常高，不可持续，并导致智能手机电池很快耗尽。这项研究通过设计显着降低智能手机上加密身份验证协议的能源成本的新技术，推进了隐私保护主动身份验证的最新技术。此外，这项研究考虑了表明用户失去智能手机的信号，以便仅在必要时触发用户身份验证。该项目的重点与现有技术和协议形成鲜明对比，现有技术和协议在很大程度上与能源消耗模式以及用户在身份验证后拥有智能手机的情况无关。该项目的成果是一套新的加密技术和占有感知协议，可以对智能手机用户进行安全、节能的主动身份验证。这些加密技术通过重新塑造各个协议组件以考虑复杂的能源权衡和网络异构性（现代智能手机的组成部分），从而推进了隐私保护主动身份验证的最新技术。最后，该项目将重点关注新技术，以安全地将与主动身份验证相关的计算从智能手机转移到（可能不受信任的）云，从而进一步减少身份验证的能源足迹。因此，从能源和性能的角度来看，拟议的研究将使保护隐私的主动身份验证在智能手机上变得实用。