CSR: Small: Behavior Based User Authentication for Mobile Devices

配备有触摸屏的移动的设备具有越来越丰富的功能、增强的计算能力和更大的存储容量。这些设备通常包含私人信息，如个人照片，电子邮件，甚至公司数据。因此，具有用于触摸屏设备的安全且方便的用户认证机制至关重要。然而，在这方面，广泛使用的基于密码/PIN/模式的解决方案容易受到肩冲浪的影响（因为移动的设备经常在公共场合使用，而在公共场合，肩膀冲浪经常会故意或无意地发生）和污迹攻击（因为手指在触摸屏上留下的油性残留物可以被冒名顶替者识别）并且有时对于用户在步行或驾驶时输入是不方便的。本项目的目标是开发一种用于触摸屏设备的基于行为的用户认证方法。行为身份验证不是仅基于用户输入的内容（例如密码/PIN/模式）进行身份验证，而是基于用户如何提供输入。具体地，首先要求用户在触摸屏上执行某些动作，例如手势/签名，然后从动作中提取行为特征信息（例如速度大小和设备加速度）以基于机器学习技术来认证用户。所提出的方法背后的直觉是，人们在触摸屏上执行手势和签名的行为是一致的和有区别的。与当前的触摸屏设备用户认证方案相比，所提出的方法更难妥协，因为冒名顶替者几乎不可能通过肩部冲浪或涂抹攻击来复制其他人做手势/签名的行为-他们可以看到它，但他们做不到。这个项目将促进对触摸屏设备上基于行为的用户认证的知识和理解。这是一项具有潜在变革性和高影响力的研究。如果成功的话，这个项目将不仅产生一个理论基础，基于行为的用户认证的触摸屏设备，但也邀请未来的研究沿着这一方向。

Mobile devices equipped with touch screens have increasingly rich functionality, enhanced computing power, and greater storage capacity. These devices often contain private information such as personal photos, emails, and even corporate data. Therefore, it is crucial to have secure yet convenient user authentication mechanisms for touch screen devices. However, the widely used password/PIN/pattern based solutions are susceptible to shoulder surfing (as mobile devices are often used in public settings where shoulder surfing often happens either purposely or inadvertently) and smudge attacks (as oily residues left by fingers on touch screens can be recognized by impostors) and are sometimes inconvenient for users to input when they are walking or driving.The goal of this project is to develop a behavior based user authentication approach for touch screen devices. Rather than authenticating users solely based on what they input (such as a password/PIN/pattern), Behavioral Authentication is based upon how users provide input input. Specifically, a user is first asked to perform certain actions, such as gestures/signatures, on touch screens and then the behavior feature information (such as velocity magnitude and device acceleration) is extracted from the actions to authenticate the user based on machine learning techniques. The intuition behind the proposed approach is that people have consistent and distinguishing behavior of performing gestures and signatures on touch screens. Compared with current user authentication schemes for touch screen devices, the proposed approach is significantly more difficult to compromise because it is nearly impossible for impostors to reproduce the behavior of others doing gestures/signatures through shoulder surfing or smudge attacks - they can see it, but they cannot do it.This project will advance the knowledge and understanding of behavior based user authentication on touch screen devices. This is potentially transformative research with high-impact. If successful, this project will not only yield a theoretical foundation for behavior based user authentication on touch screen devices but also invite future research along this direction.