Authentication of Smartphone Users Based on Activity Recognition and Mobile Sensing
Total Page:16
File Type:pdf, Size:1020Kb
sensors Article Authentication of Smartphone Users Based on Activity Recognition and Mobile Sensing Muhammad Ehatisham-ul-Haq 1,*, Muhammad Awais Azam 1, Jonathan Loo 2, Kai Shuang 3,*, Syed Islam 4, Usman Naeem 4 and Yasar Amin 1 1 Faculty of Telecom and Information Engineering, University of Engineering and Technology, Taxila, Punjab 47050, Pakistan; [email protected] (M.A.A.); [email protected] (Y.A.) 2 School of Computing and Engineering, University of West London, London W5 5RF, UK; [email protected] 3 State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China 4 School of Architecture, Computing and Engineering, University of East London, London E16 2RD, UK; [email protected] (S.I.); [email protected] (U.N.) * Correspondence: [email protected] (M.E.H); [email protected] (K.S.) Received: 21 June 2017; Accepted: 7 August 2017; Published: 6 September 2017 Abstract: Smartphones are context-aware devices that provide a compelling platform for ubiquitous computing and assist users in accomplishing many of their routine tasks anytime and anywhere, such as sending and receiving emails. The nature of tasks conducted with these devices has evolved with the exponential increase in the sensing and computing capabilities of a smartphone. Due to the ease of use and convenience, many users tend to store their private data, such as personal identifiers and bank account details, on their smartphone. However, this sensitive data can be vulnerable if the device gets stolen or lost. A traditional approach for protecting this type of data on mobile devices is to authenticate users with mechanisms such as PINs, passwords, and fingerprint recognition. However, these techniques are vulnerable to user compliance and a plethora of attacks, such as smudge attacks. The work in this paper addresses these challenges by proposing a novel authentication framework, which is based on recognizing the behavioral traits of smartphone users using the embedded sensors of smartphone, such as Accelerometer, Gyroscope and Magnetometer. The proposed framework also provides a platform for carrying out multi-class smart user authentication, which provides different levels of access to a wide range of smartphone users. This work has been validated with a series of experiments, which demonstrate the effectiveness of the proposed framework. Keywords: activity recognition; behavioral biometrics; continuous sensing; micro-environment sensing; mobile sensing; smartphone authentication; ubiquitous computing 1. Introduction Smartphones are ubiquitous, becoming more and more sophisticated with the advancement in their computing, sensing, and networking powers. Currently, 68% of the world’s population own a mobile phone, and by 2019 this figure is expected to be in the region of 72% [1]. Market research on the sale of smartphone has shown that the number of smartphones sold has surpassed the number of laptops sold worldwide [2]. The pervasive nature of smartphones, together with integrated sensing capabilities, has changed the landscape of people’s everyday life. Smartphones have become the guardians for most of our personal information, such as medical information (e.g., heart rate), bank account details, and personal credentials for different services and applications. With the increasing use of smartphones, users have begun to worry about the confidentiality of their data and information. As smartphones are intended for quick and recurrent access, it can lead to Sensors 2017, 17, 2043; doi:10.3390/s17092043 www.mdpi.com/journal/sensors Sensors 2017, 17, 2043 2 of 28 Sensors 2017, 17, 2043 2 of 31 smartphones are intended for quick and recurrent access, it can lead to compromised privacy of compromisedsmartphone data privacy and information of smartphone [3]. It data has andnow information become critical [3]. to It maintain has now the become privacy critical of sensitive to maintain data theand privacyinformation of sensitive available data andthrough information these devices available using through non-intrusive these devices yet using viable non-intrusive authentication yet viablemechanisms. authentication mechanisms. Unfortunately, mostmost widely widely used used authentication authentica methodstion methods for smartphones for smartphones including passwords,including PINs,passwords, pattern PINs, locks, pattern and fingerprint locks, and scans fingerprint offer limited scans safekeeping offer limited [3], as safekeeping they are vulnerable [3], as they to many are attacksvulnerable including to many guessing attacks [including4], spoofing guessing [5] in case [4], ofspoofing fingerprint [5] in scans, case andof fingerprint the side channel scans, and attacks the suchside channel as video attacks capture such attacks as video [6], or capture smudge attacks attacks [6], [7 ].or Secure smudge passwords attacks [7]. are Secure often notpasswords considered are tooften be appropriatenot considered for to use be onappropriate smartphones for use due on to sm theartphones length of due time to required the length for of their time input. required Many for smartphonestheir input. Many provide smartphones PINs as alternatives provide PINs to passwords.as alternatives PINs to passwords. have the benefit PINs ofhave being the ablebenefit to beof enteredbeing able quickly, to be butentered they quickly, provide but far lessthey safekeeping provide far thanless safekeeping passwords, asthan they passwords, may be guessed as they more may quicklybe guessed [3]. more Pattern quickly locks [3]. provide Pattern protection locks provide by allowing protection users by to allowing choose a users sequence to choose of points a sequence during enrollmentof points during and then enrollment repeating and it duringthen repeating authentication. it during However, authentication. these pattern However, locks these are exposed pattern tolocks side are channel exposed attacks, to sideand channel the user’sattacks, fingertips and the user’s often fingertips leave a distinguishing often leave a distinguishing trace on the screen, trace whichon the canscreen, indicate which the can pattern indicate that the was pattern used tothat access was theused device to access [3]. Moreover,the device these[3]. Moreover, authentication these methodsauthentication require methods a user torequire deal witha user the to smartphonedeal with the actively smartphone and spendactively a fewand spend precious a few seconds precious for inputtingseconds for some inputting valid pieces some of valid information, pieces orof drawinginformation, sophisticated or drawing patterns sophisticated on touchscreen, patterns which on hastouchscreen, become a which frustration has become for the millionsa frustration of smartphone for the millions users of worldwide. smartphone As users a result, worldwide. many people As a likeresult, to usemany fewer people privacy like to barriers use fewer each privacy time they barrier decides each to time access they their decide device to access [8], which their is device reducing [8], thewhich effectiveness is reducing of suchthe authenticationeffectiveness of schemes, such au ultimatelythentication making schemes, them vulnerableultimately tomaking data theft. them In addition,vulnerable these to data commonly theft. In used addition, methods these for co authenticationmmonly used failmethods to detect for andauthentication recognize anfail adversary to detect onceand recognize he/she has an passed adversary the point once of entryhe/she [9 ],has which pass makesed the these point approaches of entry futile[9], which for continuous makes these and non-intrusiveapproaches futile passive for continuous authentication. and non-intrusive passive authentication. Continuous andand passivepassive authentication authentication aims aims to to address address these these challenges challenges by by offering offering a way a way to use to behavioraluse behavioral biometrics biometrics for authenticating for authenticating a smartphone a smartphone user continuously user continuously [9]. Behavioral [9]. Behavioral biometrics basedbiometrics authentication based authentication scheme targets scheme to learntargets the to characteristicslearn the characteristics of the user of behavior the user thatbehavior does that not changedoes not over change a period over of a time,period such of astime, gait such patterns as gait [10 ],patterns hand movements [10], hand andmovements waving patternsand waving [11], voicepatterns [12 ],[11], signature voice [12], [13], signature and touchscreen [13], and interactions touchscreen [ 14interactions,15]. These [14,15]. characteristics These characteristics are then used are to implicitlythen used authenticateto implicitly aauthenticate smartphone a usersmartphone to prevent user unauthorized to prevent unauthorized access to the access device. to This the device. type of authenticationThis type of authentication works passively works in passively the background in the background and monitors and the monitors interactions the interactions between a userbetween and thea user device and tothe make device a decisionto make abouta decision the authenticityabout the au ofthenticity the user of who the isuser trying who to is use trying the deviceto use the [9]. Thedevice user [9]. authentication The user authentication decision is decision taken on is the taken basis on of the distinctive basis of distinctive features identified features fromidentified the