TWC: Small: Collaborative: Towards Energy-Efficient Privacy-Preserving Active Authentication of Smartphone Users

TWC：小型：协作：实现智能手机用户的节能隐私保护主动身份验证

• 批准号: 1618300
• 负责人: Gang Zhou
• 金额: $ 20.43万
• 依托单位: College of William and Mary
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-10-01 至 2019-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1618300&HistoricalAwards=false
• 关键词: TWC; Small; Collaborative; Towards; Energy

Common smartphone authentication mechanisms such as PINs, graphical passwords, and fingerprint scans offer limited security. They are relatively easy to guess or spoof, and are ineffective when the smartphone is captured after the user has logged in. Multi-modal active authentication addresses these challenges by frequently and unobtrusively authenticating the user via behavioral biometric signals, such as touchscreen interaction, hand movements, gait, voice, and phone location. However, these techniques raise significant privacy and security concerns because the behavioral signals used for authentication represents personal identifiable data, and often expose private information such as user activity, health, and location. Because smartphones can be easily lost or stolen, it is paramount to protect all sensitive behavioral information collected and processed on these devices. One approach for securing behavioral data is to perform off-device authentication via privacy-preserving protocols. However, our experiments show that the energy required to execute these protocols, implemented using state-of-the-art techniques, is unsustainably high, and leads to very quick depletion of the smartphone's battery. This research advances the state of the art of privacy-preserving active authentication by devising new techniques that significantly reduce the energy cost of cryptographic authentication protocols on smartphones. Further, this research takes into account signals that indicate that the user has lost possession of the smartphone, in order to trigger user authentication only when necessary. The focus of this project is in sharp contrast with existing techniques and protocols, which have been largely agnostic to energy consumption patterns and to the user1s possession of the smartphone post-authentication. The outcome of this project is a suite of new cryptographic techniques and possession-aware protocols that enable secure energy-efficient active authentication of smartphone users. These cryptographic techniques advance the state of the art of privacy-preserving active authentication by re-shaping individual protocol components to take into account complex energy tradeoffs and network heterogeneity, integral to modern smartphones. Finally, this project will focus on novel techniques to securely offload computation related to active authentication from the smartphone to a (possibly untrusted) cloud, further reducing the energy footprint of authentication. The proposed research will thus make privacy-preserving active authentication practical on smartphones, from both an energy and performance perspective.

常见的智能手机身份验证机制，例如引脚，图形密码和指纹扫描，可提供有限的安全性。它们相对易于猜测或欺骗，并且在用户登录后捕获智能手机时无效。多模式主动身份验证通过经常且无效地通过行为生物识别信号来验证用户，例如通过行为生物识别信号来解决这些挑战，例如触摸屏交互，手动移动，手动，语音，语音和手机位置。但是，这些技术引起了严重的隐私和安全问题，因为用于身份验证的行为信号代表了个人可识别的数据，并且经常暴露私人信息，例如用户活动，健康和位置。由于智能手机很容易丢失或被盗，因此保护所有在这些设备上收集和处理的敏感行为信息至关重要。确保行为数据的一种方法是通过隐私权协议执行偏离设备身份验证。但是，我们的实验表明，执行这些协议所需的能量，使用最先进的技术实施，是不可持续的，并且导致智能手机电池的耗尽很快。这项研究通过设计新技术可大大降低智能手机上的加密认证协议的能源成本，从而推动保护隐私积极身份验证的艺术状况。此外，这项研究考虑了表明用户失去智能手机的信号，以便仅在必要时触发用户身份验证。该项目的重点与现有的技术和协议形成鲜明对比，这些技术和协议在很大程度上对能耗模式不可知，并且在智能手机后拥有智能手机。该项目的结果是一套新的加密技术和所有拥有的协议，可实现智能手机用户的安全有效的主动身份验证。这些加密技术通过重新塑造单个协议组件来考虑复杂的能源折衷和网络异质性，这是现代智能手机不可或缺的一部分。最后，该项目将重点介绍与从智能手机到（可能不受信任的）云的主动身份验证有关的新型技术，从而进一步降低了身份验证的能量足迹。因此，拟议的研究将从能量和性能的角度来看，在智能手机上具有保护隐私的积极认证。