SaTC: CORE: Small: Collaborative: Cardiac Password: Exploring a Non-Contact and Continuous Approach to Secure User Authentication

大多数传统安全系统仅在初始登录会话时对用户进行身份验证。因此，在初始用户注销之前，无论是否获得登录用户的许可，其他授权或未经授权的用户都可以访问系统信息。即使对于高度安全的系统，这也可能是一个严重的安全漏洞。传统的一次性(例如，口令)或双因素(例如，带有指纹的口令)认证方法不再足够。连续身份验证是一种动态的、基于风险的身份验证形式，它将身份验证的视角从事件更改为进程，并有可能通过在会话使用期间持续验证用户的身份来解决现有安全系统的漏洞。这个跨学科团队通过一种变革性的非接触式心脏生物识别技术探索了一种新颖的连续身份验证方法。该项目可以改变人们对心脏运动中非挥发性成分的理解，并将这种新知识和相关技术转化为日益脆弱的网络空间中更好的安全性。该项目建立了一个独特的关于网络安全的大学间研究和教育计划，涉及K-12、本科生和代表性不足的人群。心脏密码项目研究一种整体硬件/软件解决方案，通过非接触式心脏运动传感来确保安全和值得信赖的持续身份验证。新的身份验证系统可以以非接触、不引人注目甚至非视线的方式识别人类。为了实现这一目标，该项目有三个推动力。首先，该团队开发了一种高保真非接触式心脏运动传感设备。其次，该团队研究了不变的心脏描述符，并提出了持续的认证方法。第三，该团队评估拟议的心脏密码系统的性能、可用性和脆弱性。这项研究的结果可以促进最先进的基于心脏的生物识别在用户身份验证中的应用，并为开发更不可欺骗性、抗泄密和用户友好的生物识别解决方案提供见解。研究人员将通过出版物、讲座和演示来传播该项目的成果，并将研究成果纳入教育课程。

Most traditional security systems authenticate a user only at the initial log-in session. As a result, it is possible for another user, authorized or unauthorized, to access the system information, with or without the permission of the signed-on user, until the initial user logs out. This could be a critical security flaw even for high-security systems. Traditional one-time (e.g., password) or two-factor (e.g., password with fingerprint) authentication methods are no longer sufficient. Continuous authentication is a form of dynamic, risk-based authentication that changes the perspective of authentication from an event to a process, and has the potential to address the vulnerability of existing security systems by continuously verifying the user's identity during the session use. This interdisciplinary team explores a novel continuous authentication through a transformative non-contact heart-based biometrics. This project could transform the understanding of non-volatile components in cardiac motion, and convert this new knowledge and related technologies into improved security in increasingly vulnerable cyberspace. The project establishes a unique inter university research and education program on cyber security, which involves both K-12, undergraduate students, and underrepresented populations.The Cardiac Password project investigates a holistic hardware/software solution to secure and trustworthy continuous authentication via non-contact cardiac motion sensing. The new authentication system can recognize humans in a non-contact, unobtrusive and even non-line-of-sight fashion. Towards this goal, the project has three thrusts. First, the team develops a high-fidelity non-contact cardiac motion sensing device. Second, the team investigates invariant cardiac descriptors and propose continuous authentication methodologies. Third, the team assesses the performance, usability, and vulnerability of the proposed Cardiac Password system. The outcome of this research can advance state-of-the-art heart-based biometrics in user authentication, and provide insights on developing more undeceivable, disclosure-resistant and user-friendly biometric solutions. The investigators will disseminate the results of the project through publications, talks, and demos, and integrate the research results into education curricula.