SaTC: TTP: Small: Collaborative: Privacy-Aware Wearable-Assisted Continous Authentication Framework

移动或桌面设备的登录过程不能保证使用它的人一定是预期用户。如果用户长时间登录，则应该在整个会话期间定期重新验证用户的身份，而不影响他们的体验，这在现有的登录和身份验证系统中是不容易实现的。因此，在不中断用户浏览会话的情况下重新验证用户的连续身份验证是必要的。然而，这种设置中的身份验证是高度侵入性的，可能会将用户的敏感信息暴露给第三方。为了解决这些问题，该项目开发了一种新颖的隐私感知可穿戴辅助连续身份验证（WACA）框架。用户特定数据通过可穿戴设备上的内置传感器获取。用户数据在整个身份验证过程中都要经过隐私保护操作。此登录过程可以应用于各种现有的企业认证系统，例如大学校园、企业信息技术部门和政府机构。佛罗里达国际大学（FIU）和佛罗里达大西洋大学（FAU）的原型部署为未来的改进提供了有价值的反馈，这两所大学都为大量不同的学生群体提供服务。在当今以互联网为中心的永远在线的社会中，持续认证和数字隐私是及时而相关的话题。该项目利用基于传感器的可穿戴设备的无所不在的特性，设计了一种创新的、可用的连续认证机制。通过利用项目团队在身份验证、隐私保护和机器学习方面的专业知识，该项目解决了以下问题：1)研究可穿戴智能手表上的新感官功能，并识别这些功能的最佳子集，以及距离测量和机器学习算法，以在准确性和速度之间取得平衡；2)基于安全容噪模板生成和比较技术、多方计算和同态加密的新型隐私保护机制的发现；3)权衡隐私和性能，优化方案的准确性、效率和安全性；4)基于传感器的击键动力学对一些常见攻击的安全性，如简单的零努力，模仿和更复杂的统计攻击，包括但不限于经典的纯键盘击键动力学攻击；5)在原型系统中使用一组丰富的用户、设备和使用上下文来开发、测试和部署提议的框架。WACA项目的成功将有助于隐私和身份验证领域知识的增长，以及社会对这些问题的理解。

The login process for a mobile or desktop device does not guarantee that the person using it is necessarily the intended user. If one is logged in for a long period of time, the user's identity should be periodically re-verified throughout the session without impacting their experience, something that is not easily achievable with existing login and authentication systems. Hence, continuous authentication, which re-verifies the user without interrupting their browsing session, is essential. However, authentication in such settings is highly intrusive and may expose users' sensitive information to third parties. To address these concerns, this project develops a novel privacy-aware wearable-assisted continuous authentication (WACA) framework. User specific data is acquired through built-in sensors on a wearable device. The user data is goes through privacy-preserving operations throughout the authentication process. This login procedure can be applied to a wide variety of existing enterprise authentication systems such as university campuses, corporate Information Technology divisions, and government agencies. Prototype deployments at Florida International University (FIU) and Florida Atlantic University (FAU), both of which serve large and diverse student populations, provide valuable feedback for future improvements. Continuous authentication and digital privacy are timely and relevant topics in today's Internet-centric always-on society. This project exploits the ubiquitous nature of sensor-based wearables by designing an innovative usable continuous authentication mechanism. By leveraging the expertise of the project team on authentication, privacy-preservation, and machine learning, this project addresses the following problems: 1) Investigation of novel sensory features on wearable smartwatches and identification of an optimal subset of these features along with distance measures and machine-learning algorithms to strike the balance between accuracy and speed; 2) Discovery of novel privacy-preserving mechanisms based on secure noise-tolerant template generation and comparison techniques, multi-party computation, and homomorphic encryption; 3) Trade-offs between privacy and performance to optimize the scheme in terms of accuracy, efficiency, and security; 4) Security of sensor-based keystroke dynamics against some common attacks such as simple zero-effort, imitation, and more complex statistical attacks including, but not limited to, classical keyboard-only keystroke dynamics attacks; and 5) Development, testing, and deployment of the proposed framework with a rich set of users, devices, and usage context in a prototype system. The success of the WACA project will contribute to the growth of knowledge in privacy and authentication domains and to societal understanding of these matters.