Novel Software-based Biometrics for Security of Mobile Devices

近年来，我们见证了移动设备的复杂程度和计算能力的显著提高。这些设备正越来越多地被用于存储重要的公司或机构数据，并执行一度仅限于办公室或公司发布的桌面的任务。矛盾的是，尽管移动设备无处不在，而且它们越来越多地托管敏感计算，但底层安全做法和机制几乎没有什么新的发展。虽然更换丢失或被盗设备的成本过去是主要风险，但现在未经授权访问存储在设备上的数据构成了更严重的威胁。尽管移动设备正在快速发展，但作为任何保护战略中最关键的组件的身份验证机制几乎没有变化，密码等基于知识的方案是最常用的方法。然而，密码很容易被窃取或破解。在这种背景下，近年来出现了生物识别技术，作为对移动用户身份验证的密码的替代或加强。生物识别技术大致分为生理生物识别和行为生物识别。许多智能手机公司都在努力将主要是生理生物识别技术整合到他们的智能设备中。大多数生理生物识别解决方案，如虹膜、视网膜、眼睛和面部生物识别，都很容易受到光照变化的影响，并可能被高质量的图像愚弄。此外，用于台式机器的可靠的生物识别扫描仪和传感器的成本非常昂贵。因此，为手机设计高可靠的生物识别传感器预计会增加终端用户的设备成本。相比之下，行为生物识别技术并不面临这样的挑战，因为它们只依赖移动平台(例如触摸屏、键盘、麦克风)上有机提供的传感器。此外，它们可以在后台透明地收集，这使得它们更适合移动终端环境中的持续用户认证。我们研究计划的目的是研究结合移动用户行为和认知特征的新生物识别模型。拟议的安全模型将被利用并用作基于风险的身份验证和访问控制的基础，以及将人类活动与移动终端设备中的恶意自动应用程序(即僵尸网络)活动模式区分开来。拟议的研究将加强移动设备的安全，并允许有效和透明地缓解移动僵尸网络日益增长的威胁。该研究还将允许对几名HQP进行移动设备安全威胁评估和缓解方面的培训。

In recent years, we have witnessed a significant increase in the level of sophistication and computing power of mobile devices. These devices are increasingly being used to store important corporate or institutional data, and perform tasks that were once restricted to the confines of the office or the company-issued desktop. Paradoxically, despite the ubiquity of mobile devices and the fact they are increasingly hosting sensitive computations, there has been little evolution in underlying security practices and mechanisms. While the cost of replacing lost or stolen devices used to be the main risk, now unauthorized access to the data stored on them represents a more serious threat. Despite the evolution of mobile devices, the authentication mechanism which is the most crucial component of any protection strategy remains virtually unchanged, with knowledge-based schemes such as passwords being the most commonly used approach. However, passwords can easily be stolen or cracked. In this context, biometric technologies have emerged recently as alternatives to or reinforcement for passwords in authenticating mobile users. Biometric technologies are broadly categorized into physiological and behavioral biometrics. Many smartphone companies are working on integrating primarily physiological biometric technologies in their devices. Most of the physiological biometrics solutions such as iris, retina, and face biometrics can easily be affected by changes in lighting, and can be fooled by a high quality image. In addition, the cost of reliable biometric scanners and sensors for desktop machine is very expensive. Therefore, designing highly reliable biometric sensors for mobile phones is expected to increase the cost of the devices for the end-users. In contrast, behavioral biometric technologies do not face such challenges as they rely only on sensors organically available on mobile platforms (e.g., touchscreen, keypad, microphone). Furthermore, they can be collected transparently in the background, which makes them more suitable for continuous user authentication in mobile environments. The purpose of our research program is to investigate new biometric recognition models that combine mobile users’ behavioral and cognitive characteristics. The proposed models will be leveraged and used as a foundation for risk-based authentication and access control, as well as for differentiating human activities from malicious automated application (i.e., botnet) activity patterns in mobile devices. The proposed research will strengthen the security of mobile devices and allow mitigating effectively and transparently the rising threat of mobile botnets. The research will also allow training several HQPs in security threat assessment and mitigation for mobile devices.