CAREER: Science of Security for Mobile User Authentication

移动设备包含个人、私人和财务信息的集合，如果被未经授权的用户访问，就有可能造成严重的危害。因此，对于移动设备来说，验证其用户是否被允许访问设备及其服务非常重要。我们称之为移动身份验证，它是频繁、普遍和必要的。无论最终用户是否选择不使用身份验证，了解保护数据免受未经授权访问的需求都很重要。制造商和研究人员有责任提供每个人都可以使用的可用和安全的方法。要达到这一点，需要扎实的科学理解。该项目将科学评估准确评估移动身份验证的指标和测量技术，并使用这些指标来推动新身份验证系统的设计。该项目的动机是以下观察：1)人们正在从台式机转向智能手机作为他们主要的计算和互联网平台，2)移动平台为巧妙的身份验证方法提供了机会，3)尽管科学和工程社区正在为移动身份验证提供许多解决方案，但移动身份验证背后的潜在权衡和科学并没有得到很好的理解。该项目独特地整合了研究和教育，并促进了K-12、高中、本科和研究生学习中科学、技术、工程和数学（STEM）领域代表性不足的学生。这是一个跨学科的项目，它利用了几个学科，包括安全工程，移动计算和人机交互。本项目将提高用户身份验证和安全方面的基本知识。为此，该项目将1)开发一个基于统计误差分析的框架，用于评估用户身份验证系统；2)创建如何评估和设计实验的指导方针，以确保可比性和可重复性；3)研究影响基于秘密知识的身份验证系统的认知过程；4)设计、原型和实施新型轻量级移动友好型身份验证系统。5)探索防止认知超载和确保移动安全的创新方法。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Mobile devices contain a collection of personal, private, and financial information that, if accessed by an unauthorized user, has the potential to be severely compromising. Thus, it is important for mobile devices to verify whether their users are allowed to access the device and its services. We call this mobile authentication, and it is frequent, prevalent, and necessary. The need to protect data from unauthorized access is important to understand, irrespective of whether an end-user ultimately opts out of using authentication. It is incumbent on manufacturers and researchers to provide usable and secure methods that everyone can use. To reach that point requires solid scientific understanding. This project will scientifically evaluate the metrics and measurement techniques for accurately assessing mobile authentication, and use those metrics to drive the design of new authentication systems. The project is motivated by the following observations: 1) people are switching from desktops to smartphones as their main computing and Internet platform, 2) mobile platforms provide opportunities for ingenious authentication methods, and 3) although the scientific and engineering community is producing many solutions to mobile authentication, the underlying trade-offs and science behind mobile authentication are not well understood. This project uniquely integrates research and education and promotes underrepresented students in Science, Technology, Engineering and Mathematics (STEM) in K-12, high school, undergraduate and graduate studies. This is an interdisciplinary project that leverages several disciplines including security engineering, mobile computing and human-computer interaction. This project will advance fundamental knowledge on user authentication and security. Towards that end, the project will 1) develop a framework grounded in statistical error analysis for evaluating user authentication systems, 2) create guidelines on how to evaluate and design experiments to ensure comparability and reproducibility, 3) study the cognitive processes that impact secret-knowledge based authentication systems, 4) design, prototype, and implement, novel lightweight mobile-friendly authentication systems, and 5) explore innovative approaches that prevent cognitive overload and ensure security while mobile.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.