CAREER: Enhancing Mobile Authentication by Measuring the Authentication Life-Cycle

职业：通过衡量身份验证生命周期来增强移动身份验证

• 批准号: 1845300
• 负责人: Adam Aviv
• 金额: $ 70万
• 依托单位: George Washington University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2019
• 资助国家: 美国
• 起止时间: 2019-10-01 至 2024-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1845300&HistoricalAwards=false
• 关键词: CAREER; Enhancing; Mobile; Authentication; Measuring

This CAREER research focuses on human factors in authentication using mobile devices. Mobile authentication is a crucial component of authentication, especially as mobile devices become ever more connected to the broader security ecosystem. A major concern is how users authenticate as they use their devices over months or years. This research will involve empirical studies of the choices and actions users take over time. Qualitative and quantitative measures will be employed to better understand user mental models, perceptions, and behaviors related to mobile authentication. The overall goal is to understand the life-cycle of authentication on mobile devices. The outcomes of this work will drive the design and implementation of mobile authentication, and policies surrounding mobile authentication. The research will help to mitigate or prevent security attacks on mobile devices, and lead to better security and privacy of data in mobile devices.Empirical measurements and improvements to mobile authentication have the potential to provide significant intellectual impact and lay the ground work for transformative technologies that improve the way we choose and use authenticators on our mobile devices. This project will accomplish that in two key ways. First, the research makes contributions to the study of user behavior as it unfolds over time, and how that behavior is affected by device use, context, and perceptions. Second, measures of life-cycle events in mobile authentication will be used to understand how behavior shifts over time. The research will also expand the typically-tested populations of students and online users to understand how other user populations, such as older adults, approach authentication and may require different solutions or interventions. The outcome of this work will fill important knowledge gaps regarding the upgrade cycle of mobile devices and our understanding of mobile authentication selection, leading to the design of new policies, procedures, and systems for mobile authentication. Students will be involved at all stages of the research.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

这项职业研究的重点是使用移动设备身份验证的人为因素。移动身份验证是身份验证的关键组成部分，尤其是当移动设备与更广泛的安全生态系统连接时。一个主要问题是用户在数月或数年内使用设备时如何进行身份验证。这项研究将涉及对用户随着时间的选择和行动的经验研究。定性和定量措施将采用与移动身份验证相关的用户心理模型，看法和行为。总体目标是了解移动设备身份验证的生命周期。这项工作的结果将推动移动身份验证的设计和实施以及围绕移动身份验证的政策。这项研究将有助于减轻或防止对移动设备的安全攻击，并在移动设备中提高数据的安全性和隐私性。经验测量和移动身份验证的改进有可能提供重大的智力影响，并为改善我们在移动设备上选择和使用身份验证器的方式提供基础工作。该项目将以两种关键方式实现这一目标。首先，该研究为对用户行为的研究做出了贡献，随着时间的流逝，该行为如何受到设备使用，上下文和看法的影响。其次，移动身份验证中生命周期事件的衡量标准将用于了解行为如何随着时间的流逝而变化。这项研究还将扩大典型的学生和在线用户的测试人群，以了解其他用户群体（例如老年人）如何进行身份验证，并可能需要不同的解决方案或干预措施。这项工作的结果将填补有关移动设备升级周期以及我们对移动身份验证选择的理解的重要知识差距，从而设计了新的政策，程序和移动身份验证系统。学生将参与研究的各个阶段。该奖项反映了NSF的法定任务，并通过使用基金会的知识分子优点和更广泛的影响审查标准来评估，被认为值得支持。

项目成果

"In Eighty Percent of the Cases, I Select the Password for Them": Security and Privacy Challenges, Advice, and Opportunities at Cybercafes in Kenya

“在百分之八十的情况下，我会为他们选择密码”：肯尼亚网吧的安全和隐私挑战、建议和机遇

• 发表时间: 2023
• 期刊: 2023 IEEE Symposium on Security and Privacy
• 作者: Munyendo, Collins;Acar, Yasemin;Aviv, Adam J.
• 通讯作者: Aviv, Adam J.

Double Patterns: A Usable Solution to Increase the Security of Android Unlock Patterns

• DOI: 10.1145/3427228.3427252
• 发表时间: 2020-01-01
• 期刊: 36TH ANNUAL COMPUTER SECURITY APPLICATIONS CONFERENCE (ACSAC 2020)
• 作者: Forman, Timothy J.;Aviv, Adam J.
• 通讯作者: Aviv, Adam J.

User Perceptions of Five-Word Passwords

• DOI: 10.1145/3564625.3567981
• 发表时间: 2022-12
• 期刊: Proceedings of the 38th Annual Computer Security Applications Conference
• 作者: Xiaoyuan Wu;Collins W. Munyendo;Eddie Cosic;Genevieve A. Flynn;Olivia Legault;Adam J. Aviv

Why Users (Don't) Use Password Managers at a Large Educational Institution

为什么用户（不）在大型教育机构使用密码管理器

• 发表时间: 2022
• 期刊: 31st USENIX Security Symposium (USENIX Security 22
• 作者: Mayer, Peter;Munyendo, Collins W.;Mazurek, Michelle L.;Aviv, Adam J.
• 通讯作者: Aviv, Adam J.

This PIN Can Be Easily Guessed: Analyzing the Security of Smartphone Unlock PINs

• DOI: 10.1109/sp40000.2020.00100
• 发表时间: 2020-01-01
• 期刊: 2020 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP 2020)
• 作者: Markert, Philipp;Bailey, Daniel, V;Aviv, Adam J.
• 通讯作者: Aviv, Adam J.