| NSF Org: |
CNS Division Of Computer and Network Systems |
| Recipient: |
|
| Initial Amendment Date: | March 16, 2021 |
| Latest Amendment Date: | May 20, 2021 |
| Award Number: | 2039379 |
| Award Instrument: | Standard Grant |
| Program Manager: |
Jeremy Epstein
CNS Division Of Computer and Network Systems CSE Directorate for Computer and Information Science and Engineering |
| Start Date: | April 1, 2021 |
| End Date: | March 31, 2023 (Estimated) |
| Total Intended Award Amount: | $255,486.00 |
| Total Awarded Amount to Date: | $255,486.00 |
| Funds Obligated to Date: |
|
| History of Investigator: |
|
| Recipient Sponsored Research Office: |
1523 UNION RD RM 207 GAINESVILLE FL US 32611-1941 (352)392-3516 |
| Sponsor Congressional District: |
|
| Primary Place of Performance: |
FL US 32611-2002 |
| Primary Place of
Performance Congressional District: |
|
| Unique Entity Identifier (UEI): |
|
| Parent UEI: |
|
| NSF Program(s): | Secure &Trustworthy Cyberspace |
| Primary Program Source: |
|
| Program Reference Code(s): |
|
| Program Element Code(s): |
|
| Award Agency Code: | 4900 |
| Fund Agency Code: | 4900 |
| Assistance Listing Number(s): | 47.070 |
ABSTRACT
Current software for user authentication relies on the user to directly initiate some interaction (i.e., active authentication). However, active authentication systems are not accessible to individuals across all age groups. Continuous authentication schemes transparently observe a user's natural multimodal behaviors to leverage all possible signals as input for authentication, and hence do not require explicit authentication interactions to be initiated by the user, and are thus a promising framework for authentication by individuals of different age groups. This project's novelties are 1) to advance understanding of how individuals of different age groups use and perceive existing authentication methods, especially concerning users' mental models and acceptance of monitoring for the purposes of continuous authentication, and 2) to collect and analyze a variety of user signals in multiple behavioral and physiological modalities for age-aware continuous authentication on personal computing devices. This research also informs the design of continuous authentication interactions in other contexts such as public spaces and other smart environments, in which continuous authentication might be useful.
The research includes three phases. (1) Elicit the mental models multi-generational users have of what it means to authenticate to a system, if and when they expect the system to re-authenticate them to confirm their identity as they continue to interact, and if and how they expect to receive feedback of authentication attempts. (2) Produce a novel dataset of behavioral and physiological data, such as touch gestures, keystroke dynamics, heart-rate variability, and skin temperature, through a series of data collection sessions wherein individuals of different age groups will be recruited to complete a diverse set of tasks. (3) Develop fundamental knowledge of age-aware continuous authentication through the analysis of these data using state-of-the-art machine and deep learning techniques. This project broadens participation in computing by involving students underrepresented in STEM and through K-12 outreach.
This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.
PROJECT OUTCOMES REPORT
Disclaimer
This Project Outcomes Report for the General Public is displayed verbatim as submitted by the Principal Investigator (PI) for this award. Any opinions, findings, and conclusions or recommendations expressed in this Report are those of the PI and do not necessarily reflect the views of the National Science Foundation; NSF has not approved or endorsed its content.
The convenience offered by smart home devices such as Amazon Alexa, Google Home, and similar products has revolutionized how users interact with their living spaces. However, this convenience also raises significant challenges regarding data privacy and security. Since smart home devices are connected to the internet within the Internet of Things (IoT) environment, they become vulnerable to cyber-attacks and unauthorized access, potentially resulting in the theft of personal information or compromising users' physical security. In addition, smart home contexts often involve multiple potential users, including those of different ages such as children and older adults, whose needs, expectations, and abilities related to security, authentication, and access may vary greatly.
Continuous Authentication (CA) is an emerging security technology that intermittently verifies user identities based on passive observation and monitoring of user behaviors, without requiring users to explicitly authenticate themselves via, for example, passwords. CA allows for a more seamless user experience in the smart home and can significantly reduce the risk of unauthorized access. However, this continuous monitoring, which is required for the effective operation of smart home services, presents another layer of challenges to privacy and security. All of these concerns highlight the need for improved security measures and privacy protection in smart homes. Furthermore, developing a clear understanding of users' attitudes toward these challenges and CA in general is crucial for assessing its acceptance and potential for adoption.
In this two-year project, we conducted a series of research focus groups with over 30 participants (ages 18 to 35) to investigate how potential end-users of continuous authentication technology think about security, privacy, data, and CA. We created a conceptual video to illustrate usage scenarios for CA in lay language. These focus groups revealed key insights and a conceptual model of CA that will be informative for future design and research for this technology. Our team also conducted an exhaustive literature review to explore the state of the field in terms of understanding users' needs, expectations, and abilities regarding security and authentication, especially considering how these might vary across age groups including children and older adults.
Key findings from our focus groups research activities revealed that system transparency is a pivotal factor in mediating the relationship between users and systems for CA applications. Transparency means that the system will reveal to its users details of its operation, such as: why did it authenticate them, why didn't it authenticate them, why did it accidentally authenticate someone else, what access might it give to unauthorized users in case of errors, and so on. This concept has been explored in prior work, but the conceptual model our research generated establishes a concrete framework for thinking about design in the CA domain.
A second key finding revealed the underlying motivations users have and trade-offs that they are willing to make related to convenience of an application and security/privacy concerns of monitoring and data sharing. This willingness to compromise has been identified in cybersecurity research, but our work digs deeper into the reasons when and why users make these compromises. Our results showed that users make such trade-offs based on the context of use, the data involved, and the people/relationships involved. For example, the closer the relationship between users, the more likely they are to be willing to share or grant access to their personal data. Users also often mentioned they place more trust in large, well-known companies like Amazon and Google to safeguard their data.
Also, our literature review established a wide gap in the field's understanding of age-related differences in support of users in the security and privacy domain. The results of this research will motivate further investigation, design, and development of security and privacy technologies for security in general, and CA specifically.
Ultimately, the final outcomes of this project show that there is a clear and present need to design context-aware CA systems that provide explicit information on their security measures, privacy safeguards, and convenience features to help users of all ages make informed decisions about their adoption and use.
We have shared our research results with the public though journal publications, conference presentations, and local, national, and international events. The conceptual model we created, along with the illustrating video scenarios, can serve to inform the design and development of future CA systems for all age groups.
The broader impacts of this project at the University of Florida include the training and mentorship of eight students (seven graduate students and one undergraduate student), including four students who identify as female and one student who identifies as Latino. These students learned relevant research methods and procedures, including human-computer interaction research methods such as participant recruiting, focus groups, affinity diagramming, and quantitative data collection, as well as literature reviews, cybersecurity research, academic writing, and design methods.
Video images created with Storyboard That tool.
Last Modified: 06/02/2023
Modified by: Lisa Anthony
Please report errors in award information by writing to: awardsearch@nsf.gov.
