TWC: Small: Collaborative: RUI: Towards Energy-Efficient Privacy-Preserving Active Authentication of Smartphone Users

TWC：小型：协作：RUI：实现智能手机用户的节能隐私保护主动身份验证

• 批准号: 1619023
• 负责人: Paolo Gasti
• 金额: $ 29.55万
• 依托单位: New York Institute of Technology
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-10-01 至 2019-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1619023&HistoricalAwards=false
• 关键词: TWC; Small; Collaborative; RUI; Towards

Common smartphone authentication mechanisms such as PINs, graphical passwords, and fingerprint scans offer limited security. They are relatively easy to guess or spoof, and are ineffective when the smartphone is captured after the user has logged in. Multi-modal active authentication addresses these challenges by frequently and unobtrusively authenticating the user via behavioral biometric signals, such as touchscreen interaction, hand movements, gait, voice, and phone location. However, these techniques raise significant privacy and security concerns because the behavioral signals used for authentication represents personal identifiable data, and often expose private information such as user activity, health, and location. Because smartphones can be easily lost or stolen, it is paramount to protect all sensitive behavioral information collected and processed on these devices. One approach for securing behavioral data is to perform off-device authentication via privacy-preserving protocols. However, our experiments show that the energy required to execute these protocols, implemented using state-of-the-art techniques, is unsustainably high, and leads to very quick depletion of the smartphone's battery. This research advances the state of the art of privacy-preserving active authentication by devising new techniques that significantly reduce the energy cost of cryptographic authentication protocols on smartphones. Further, this research takes into account signals that indicate that the user has lost possession of the smartphone, in order to trigger user authentication only when necessary. The focus of this project is in sharp contrast with existing techniques and protocols, which have been largely agnostic to energy consumption patterns and to the user1s possession of the smartphone post-authentication. The outcome of this project is a suite of new cryptographic techniques and possession-aware protocols that enable secure energy-efficient active authentication of smartphone users. These cryptographic techniques advance the state of the art of privacy-preserving active authentication by re-shaping individual protocol components to take into account complex energy tradeoffs and network heterogeneity, integral to modern smartphones. Finally, this project will focus on novel techniques to securely offload computation related to active authentication from the smartphone to a (possibly untrusted) cloud, further reducing the energy footprint of authentication. The proposed research will thus make privacy-preserving active authentication practical on smartphones, from both an energy and performance perspective.

常见的智能手机身份验证机制（如PIN、图形密码和指纹扫描）提供的安全性有限。它们相对容易猜测或欺骗，并且在用户登录后捕获智能手机时无效。多模式主动身份验证通过频繁且不显眼地经由行为生物特征信号（例如触摸屏交互、手部动作、步态、语音和电话位置）来验证用户来解决这些挑战。然而，这些技术引起了严重的隐私和安全问题，因为用于认证的行为信号代表个人可识别数据，并且经常暴露诸如用户活动、健康和位置等隐私信息。由于智能手机很容易丢失或被盗，因此保护这些设备上收集和处理的所有敏感行为信息至关重要。保护行为数据的一种方法是通过隐私保护协议执行设备外身份验证。然而，我们的实验表明，执行这些协议所需的能量，使用最先进的技术实现，是不可持续的高，并导致智能手机的电池非常快耗尽。这项研究通过设计新技术，显着降低智能手机上的加密认证协议的能源成本，推进了隐私保护主动认证的最新技术。此外，这项研究还考虑了指示用户已经失去智能手机的信号，以便仅在必要时触发用户身份验证。该项目的重点是与现有的技术和协议形成鲜明对比，这些技术和协议在很大程度上不知道能源消耗模式和用户对智能手机的拥有后认证。该项目的成果是一套新的加密技术和所有权感知协议，可实现智能手机用户的安全节能主动身份验证。这些加密技术通过重新塑造各个协议组件来考虑复杂的能量权衡和网络异质性，从而推进了隐私保护主动认证的最新技术水平，这是现代智能手机不可或缺的。最后，该项目将专注于新技术，以安全地将与主动身份验证相关的计算从智能手机卸载到（可能不受信任的）云端，进一步减少身份验证的能源足迹。因此，从能源和性能的角度来看，拟议的研究将使隐私保护主动身份验证在智能手机上变得实用。