CAREER: Science of Security for Mobile User Authentication

移动的设备包含个人、私人和财务信息的集合，如果被未经授权的用户访问，这些信息可能会受到严重损害。 因此，对于移动的设备来说，验证其用户是否被允许访问该设备及其服务是重要的。我们称之为移动的身份验证，它是频繁的、普遍的和必要的。无论最终用户是否选择不使用身份验证，都必须了解保护数据免受未经授权访问的必要性。制造商和研究人员有责任提供每个人都可以使用的可用和安全的方法。要做到这一点，需要有扎实的科学认识。该项目将科学地评估用于准确评估移动的认证的指标和测量技术，并使用这些指标来推动新认证系统的设计。该项目的动机是以下观察：1）人们正在从台式机转向智能手机作为他们的主要计算和互联网平台，2）移动的平台为巧妙的身份验证方法提供了机会，3）尽管科学和工程界正在为移动的身份验证提供许多解决方案，但移动的身份验证背后的基本权衡和科学还没有得到很好的理解。该项目独特地整合了研究和教育，促进了K-12，高中，本科和研究生学习中科学，技术，工程和数学（STEM）的代表性不足的学生。这是一个跨学科的项目，利用几个学科，包括安全工程，移动的计算和人机交互。该项目将推进用户身份验证和安全的基础知识。为此，该项目将1）开发一个基于统计错误分析的框架，用于评估用户身份验证系统，2）创建如何评估和设计实验以确保可比性和可重复性的指导方针，3）研究影响基于秘密知识的身份验证系统的认知过程，4）设计，原型，并实现新的轻量级移动友好身份验证系统，和5）探索创新的方法，防止认知超载，并确保安全，而移动的。这个奖项反映了NSF的法定使命，并已被认为是值得通过评估使用基金会的智力价值和更广泛的影响审查标准的支持。

Mobile devices contain a collection of personal, private, and financial information that, if accessed by an unauthorized user, has the potential to be severely compromising. Thus, it is important for mobile devices to verify whether their users are allowed to access the device and its services. We call this mobile authentication, and it is frequent, prevalent, and necessary. The need to protect data from unauthorized access is important to understand, irrespective of whether an end-user ultimately opts out of using authentication. It is incumbent on manufacturers and researchers to provide usable and secure methods that everyone can use. To reach that point requires solid scientific understanding. This project will scientifically evaluate the metrics and measurement techniques for accurately assessing mobile authentication, and use those metrics to drive the design of new authentication systems. The project is motivated by the following observations: 1) people are switching from desktops to smartphones as their main computing and Internet platform, 2) mobile platforms provide opportunities for ingenious authentication methods, and 3) although the scientific and engineering community is producing many solutions to mobile authentication, the underlying trade-offs and science behind mobile authentication are not well understood. This project uniquely integrates research and education and promotes underrepresented students in Science, Technology, Engineering and Mathematics (STEM) in K-12, high school, undergraduate and graduate studies. This is an interdisciplinary project that leverages several disciplines including security engineering, mobile computing and human-computer interaction. This project will advance fundamental knowledge on user authentication and security. Towards that end, the project will 1) develop a framework grounded in statistical error analysis for evaluating user authentication systems, 2) create guidelines on how to evaluate and design experiments to ensure comparability and reproducibility, 3) study the cognitive processes that impact secret-knowledge based authentication systems, 4) design, prototype, and implement, novel lightweight mobile-friendly authentication systems, and 5) explore innovative approaches that prevent cognitive overload and ensure security while mobile.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.