Novel Software-based Biometrics for Security of Mobile Devices

近年来，我们见证了移动设备的复杂程度和计算能力的显著提高。这些设备越来越多地被用于存储重要的公司或机构数据，并执行曾经仅限于办公室或公司提供的桌面的任务。矛盾的是，尽管移动设备无处不在，而且它们承载着越来越多的敏感计算，但底层的安全实践和机制却几乎没有什么变化。虽然更换丢失或被盗设备的成本曾经是主要风险，但现在未经授权访问存储在设备上的数据是一个更严重的威胁。尽管移动设备不断发展，但作为任何保护策略中最重要组成部分的身份验证机制几乎没有改变，以知识为基础的方案（如密码）是最常用的方法。然而，密码很容易被盗或被破解。在这种情况下，生物识别技术最近出现，作为验证移动用户的密码的替代品或强化。生物识别技术大致分为生理生物识别和行为生物识别。许多智能手机公司正致力于将生理生物识别技术主要集成到他们的设备中。大多数生理生物识别解决方案，如虹膜、视网膜和面部生物识别，很容易受到光线变化的影响，并且可以被高质量的图像所欺骗。此外，用于台式机器的可靠的生物识别扫描仪和传感器的成本非常昂贵。因此，为手机设计高可靠性的生物识别传感器预计将增加终端用户的设备成本。相比之下，行为生物识别技术没有面临这样的挑战，因为它们只依赖于移动平台上有机可用的传感器（如触摸屏、键盘、麦克风）。此外，它们可以在后台透明地收集，这使得它们更适合于移动环境下的持续用户认证。我们的研究计划的目的是研究结合移动用户的行为和认知特征的新的生物识别模型。所提出的模型将被利用并用作基于风险的身份验证和访问控制的基础，以及用于区分移动设备中的人类活动与恶意自动化应用程序（即僵尸网络）活动模式。拟议的研究将加强移动设备的安全性，并允许有效和透明地减轻移动僵尸网络日益增长的威胁。该研究还将允许培训几个hqp对移动设备进行安全威胁评估和缓解。**

In recent years, we have witnessed a significant increase in the level of sophistication and computing power of mobile devices. These devices are increasingly being used to store important corporate or institutional data, and perform tasks that were once restricted to the confines of the office or the company-issued desktop. Paradoxically, despite the ubiquity of mobile devices and the fact they are increasingly hosting sensitive computations, there has been little evolution in underlying security practices and mechanisms. While the cost of replacing lost or stolen devices used to be the main risk, now unauthorized access to the data stored on them represents a more serious threat. Despite the evolution of mobile devices, the authentication mechanism which is the most crucial component of any protection strategy remains virtually unchanged, with knowledge-based schemes such as passwords being the most commonly used approach. However, passwords can easily be stolen or cracked. In this context, biometric technologies have emerged recently as alternatives to or reinforcement for passwords in authenticating mobile users. Biometric technologies are broadly categorized into physiological and behavioral biometrics. Many smartphone companies are working on integrating primarily physiological biometric technologies in their devices. Most of the physiological biometrics solutions such as iris, retina, and face biometrics can easily be affected by changes in lighting, and can be fooled by a high quality image. In addition, the cost of reliable biometric scanners and sensors for desktop machine is very expensive. Therefore, designing highly reliable biometric sensors for mobile phones is expected to increase the cost of the devices for the end-users. In contrast, behavioral biometric technologies do not face such challenges as they rely only on sensors organically available on mobile platforms (e.g., touchscreen, keypad, microphone). Furthermore, they can be collected transparently in the background, which makes them more suitable for continuous user authentication in mobile environments. The purpose of our research program is to investigate new biometric recognition models that combine mobile users' behavioral and cognitive characteristics. The proposed models will be leveraged and used as a foundation for risk-based authentication and access control, as well as for differentiating human activities from malicious automated application (i.e., botnet) activity patterns in mobile devices. The proposed research will strengthen the security of mobile devices and allow mitigating effectively and transparently the rising threat of mobile botnets. The research will also allow training several HQPs in security threat assessment and mitigation for mobile devices. **