Novel Software-based Biometrics for Security of Mobile Devices

点击翻译按钮获取中文摘要

In recent years, we have witnessed a significant increase in the level of sophistication and computing power of mobile devices. These devices are increasingly being used to store important corporate or institutional data, and perform tasks that were once restricted to the confines of the office or the company-issued desktop. Paradoxically, despite the ubiquity of mobile devices and the fact they are increasingly hosting sensitive computations, there has been little evolution in underlying security practices and mechanisms. While the cost of replacing lost or stolen devices used to be the main risk, now unauthorized access to the data stored on them represents a more serious threat. Despite the evolution of mobile devices, the authentication mechanism which is the most crucial component of any protection strategy remains virtually unchanged, with knowledge-based schemes such as passwords being the most commonly used approach. However, passwords can easily be stolen or cracked. In this context, biometric technologies have emerged recently as alternatives to or reinforcement for passwords in authenticating mobile users. Biometric technologies are broadly categorized into physiological and behavioral biometrics. Many smartphone companies are working on integrating primarily physiological biometric technologies in their devices. Most of the physiological biometrics solutions such as iris, retina, and face biometrics can easily be affected by changes in lighting, and can be fooled by a high quality image. In addition, the cost of reliable biometric scanners and sensors for desktop machine is very expensive. Therefore, designing highly reliable biometric sensors for mobile phones is expected to increase the cost of the devices for the end-users. In contrast, behavioral biometric technologies do not face such challenges as they rely only on sensors organically available on mobile platforms (e.g., touchscreen, keypad, microphone). Furthermore, they can be collected transparently in the background, which makes them more suitable for continuous user authentication in mobile environments. The purpose of our research program is to investigate new biometric recognition models that combine mobile users’ behavioral and cognitive characteristics. The proposed models will be leveraged and used as a foundation for risk-based authentication and access control, as well as for differentiating human activities from malicious automated application (i.e., botnet) activity patterns in mobile devices. The proposed research will strengthen the security of mobile devices and allow mitigating effectively and transparently the rising threat of mobile botnets. The research will also allow training several HQPs in security threat assessment and mitigation for mobile devices.