Novel Software-based Biometrics for Security of Mobile Devices

用于移动设备安全的基于软件的新型生物识别技术

• 批准号: RGPIN-2015-04837
• 负责人: Traore, Issa
• 金额: $ 1.75万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2016
• 资助国家: 加拿大
• 起止时间: 2016-01-01 至 2017-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=613197
• 关键词: Novel; Software; based; Biometrics; Security

In recent years, we have witnessed a significant increase in the level of sophistication and computing power of mobile devices. These devices are increasingly being used to store important corporate or institutional data, and perform tasks that were once restricted to the confines of the office or the company-issued desktop. Paradoxically, despite the ubiquity of mobile devices and the fact they are increasingly hosting sensitive computations, there has been little evolution in underlying security practices and mechanisms. While the cost of replacing lost or stolen devices used to be the main risk, now unauthorized access to the data stored on them represents a more serious threat. Despite the evolution of mobile devices, the authentication mechanism which is the most crucial component of any protection strategy remains virtually unchanged, with knowledge-based schemes such as passwords being the most commonly used approach. However, passwords can easily be stolen or cracked. In this context, biometric technologies have emerged recently as alternatives to or reinforcement for passwords in authenticating mobile users. Biometric technologies are broadly categorized into physiological and behavioral biometrics. Many smartphone companies are working on integrating primarily physiological biometric technologies in their devices. Most of the physiological biometrics solutions such as iris, retina, and face biometrics can easily be affected by changes in lighting, and can be fooled by a high quality image. In addition, the cost of reliable biometric scanners and sensors for desktop machine is very expensive. Therefore, designing highly reliable biometric sensors for mobile phones is expected to increase the cost of the devices for the end-users. In contrast, behavioral biometric technologies do not face such challenges as they rely only on sensors organically available on mobile platforms (e.g., touchscreen, keypad, microphone). Furthermore, they can be collected transparently in the background, which makes them more suitable for continuous user authentication in mobile environments. The purpose of our research program is to investigate new biometric recognition models that combine mobile users’ behavioral and cognitive characteristics. The proposed models will be leveraged and used as a foundation for risk-based authentication and access control, as well as for differentiating human activities from malicious automated application (i.e., botnet) activity patterns in mobile devices. The proposed research will strengthen the security of mobile devices and allow mitigating effectively and transparently the rising threat of mobile botnets. The research will also allow training several HQPs in security threat assessment and mitigation for mobile devices.

近年来，我们目睹了移动的设备的复杂程度和计算能力的显著提高。这些设备越来越多地用于存储重要的企业或机构数据，并执行曾经限于办公室或公司分发的桌面范围内的任务。奇怪的是，尽管移动的设备无处不在，而且它们越来越多地托管敏感计算，但底层安全实践和机制几乎没有发展。虽然更换丢失或被盗设备的成本曾经是主要风险，但现在未经授权访问存储在设备上的数据是一个更严重的威胁。尽管移动的设备不断发展，但作为任何保护策略最关键组成部分的身份验证机制几乎没有变化，基于知识的方案（如密码）是最常用的方法。然而，密码很容易被盗或被破解。在这种背景下，生物识别技术最近出现了作为认证移动的用户的密码的替代或增强。许多智能手机公司正在努力将主要的生理生物识别技术集成到他们的设备中。大多数生理生物识别解决方案，如虹膜，视网膜和面部生物识别，很容易受到光线变化的影响，并可能被高质量的图像所欺骗。此外，可靠的生物特征扫描仪和台式机传感器的成本非常昂贵，因此，为移动的电话设计高可靠性的生物特征传感器预计会增加终端用户的设备成本。相比之下，行为生物测定技术不面临这样的挑战，因为它们仅依赖于在移动的平台上有机可用的传感器（例如，触摸屏、键盘、麦克风）。此外，它们可以在后台透明地收集，这使得它们更适合于移动的环境中的连续用户认证。我们的研究计划的目的是调查新的生物识别模型，结合联合收割机移动的用户的行为和认知特征。所提出的模型将被利用并用作基于风险的身份验证和访问控制的基础，以及用于区分人类活动与恶意自动化应用程序（即，僵尸网络）活动模式。拟议的研究将加强移动的设备的安全性，并允许有效和透明地减轻移动的僵尸网络日益增长的威胁。这项研究还将允许培训几个HQP在安全威胁评估和缓解移动的设备。