Mobile devices equipped with touch screens have become prevalent in our lives with increasingly rich functionalities, enhanced computing power, and more storage capacity. These devices often contain private information such as personal photos, emails, and even corporate data. Therefore, it is crucial to have secure yet convenient user authentication mechanisms for touch screen devices. However, the widely used password/PIN/pattern based solutions are susceptible to shoulder surfing (as mobile devices are often used in public settings where shoulder surfing often happens either purposely or inadvertently) and smudge attacks (as oily residues left by fingers on touch screens can be recognized by imposters) and are sometimes inconvenient for users to input when they are walking or driving. In this project, the PI developed BEAT, a behavior based user authentication approach for touch screen devices. Rather than authenticating users solely based on what they input (such as a password/PIN/pattern), which is inherently subject to shoulder surfing and smudge attacks, BEAT authenticates users based on how they input. Specifically, BEAT first asks a user to perform certain actions, such as gestures/signatures, on touch screens and then uses the behavior feature information (such as velocity magnitude and device acceleration) extracted from the actions to authenticate the user based on machine learning techniques. The intuition behind the proposed approach is that people have consistent and distinguishing behavior of performing gestures and signatures on touch screens. Compared with current user authentication schemes for touch screen devices, the proposed approach is significantly more difficult to compromise because it is nearly impossible for imposters to reproduce the behavior of others doing gestures/signatures through shoulder surfing or smudge attacks - they can see it, but they cannot do it. This project represents the first effort towards developing behavior based user authentication approaches based on machine learning techniques for touch screen devices. The PI reveals many new observations (such as people often exhibit different behaviors when they perform the same action under different types of postures such as standing and sitting) and proposes many new concepts.

This project has advanced the knowledge and understanding of behavior based user authentication on touch screen devices. The fundamental concepts developed in this project have led to a much deeper understanding of behavior based user authentication approach for touch screen devices. In this project, the PI's team has successfully achieved the objectives of developing gesture based user authentication schemes for touch screen devices and developing signature based user authentication schemes for touch screen devices. They have proposed, implemented, and evaluated a gesture and signature behavior based authentication scheme for the authentication on touch screen devices. They have identified a set of effective features that capture the behavioral information of performing gestures and signatures on touch screens. They have developed algorithms that can automatically segments each stroke into sub-strokes of different time duration where for each sub-stroke the user has consistent and distinguishing behavior. They have also developed methods to automatically identify combined strokes in signatures and split them at appropriate locations. They have also developed algorithms to extract multiple behaviors from the training samples of a given action.

The research results have been successfully published in top tier computer science conferences (such as MOBICOM, MobiSys, and UbiComp), and computer science journals (such as IEEE Transactions on Mobile Computing, IEEE/ACM Transactions on Networking, and IEEE Journal on Selected Areas in Communications). This project has supported a number of Ph.D. students and post-docs.

The results that we developed in this project has been incorporated into the graduate courses CSE 825 "Computer and Network Security". The PI has designed course projects based on this project for students to work on. The course materials help to educate the next generation of computer engineers for the nation. In addition, this project has provided new opportunities for Ph.D. students to develop their research skills as they pursue their doctoral degrees and eventual careers in academia and/or industry.

Last Modified: 08/10/2018
Modified by: Alex X Liu