Browse > Article
http://dx.doi.org/10.13089/JKIISC.2017.27.5.1033

The Framework for Cost Reduction of User Authentication Using Implicit Risk Model  

Kim, Pyung (SeoulTech)
Seo, Kyongjin (SeoulTech)
Cho, Jin-Man (ETRI)
Kim, Soo-Hyung (ETRI)
Lee, Younho (SeoulTech)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.27, no.5, 2017 , pp. 1033-1047 More about this Journal
Abstract
Traditional explicit authentication, which requires awareness of the user's authentication process, is a burden on the user, which is one of main reasons why users tend not to employ authentication. In this paper, we try to reduce such cost by employing implicit authentication methods, such as biometrics and location based authentication methods. We define the 4-level security assurance model, where each level is mapped to an explicit authentication method. We implement our model as an Android application, where the implicit authentication methods are touch-stroke dynamics-based, face recognition based, and the location based authentication. From user experiment, we could show that the authentication cost is reduced by 14.9% compared to password authentication-only case and by 21.7% compared to the case where 6-digit PIN authentication is solely used.
Keywords
Smartphone authentication; Biometric system; Implicit authentication; Touchstroke-based dynamics; Authentication cost;
Citations & Related Records
Times Cited By KSCI : 1  (Citation Analysis)
연도 인용수 순위
1 W. Shi, J. Yang, Y. Jiang, and F. Yang, "Senguard: passive user identification on smartphones using multiple sensors," IEEE 7th International Conference on Wireless and Mobile Computing, pp. 141-148, Oct. 2011.
2 H. Khan, A. Atwater, and U. Hengartner, "A comparative evaluation of implicit authentication schemes," International Workshop on Recent Advances in Intrusion Detection. Springer, pp. 255-275, Sep. 2014.
3 V.M. Patel, R. Chellappa, D. Chandra, and B. Barbello, "Continuous user authentication on mobile devices: recent progress and remaining challenges," IEEE Signal Processing Magazine, vol. 33, no. 4, pp. 49-61, Jul. 2016.   DOI
4 Y. Xu, T. Price, J.M. Frahm, and F. Monrose, "Virtual u: defeating face liveness detection by building virtual models from your public photos," 25th USENIX Security Symposium, pp. 497-512, Aug. 2016.
5 Information Technology Laboratory, "Measuring strength of authentication," version 1, NIST, Dec. 2015.
6 "Strength of function for authenticators - biometrics," https://pages.nist.gov/SOFA/SOFA.html, NIST, Apr. 2017.
7 ISO/IEC_JTC1/SC27, "Information technology - Security techniques - Evaluation criteria for IT security," ISO/IEC 15408-3:2009, Aug. 2009.
8 Shin-young Kim, "User authentication method evaluation and selection guide for electronic financial transactions," E-finance and finance security: AR - VI - 2015 - (1) - 15, Financial Security Institute, Oct. 2015.
9 Seung-woo Han, "Comparative analysis on the security of major simple payment services," E-finance and finance security: AR - VI - 2015 - (1) - 15, Financial Security Institute, Oct. 2015.
10 B. Ur, S.M. Segreti, L. Bauer, N. Christin, L.F. Cranor, S. Komanduri, and R. Shay, "Measuring real-world accuracies and biases in modeling password guessability," In USENIX Security, pp. 463-481, Aug. 2015.
11 D. Wang, Q. Gu, X. Huang, and P. Wang, "Understanding human-chosen pins: characteristics, distribution and security," Proceedings of the 12th ACM ASIA Conference on Computer and Communications Security, Apr. 2017.
12 "Kakao pay," http://www.kakao.com/kakaopay/index.php/sendmoney/, Kakaopay corp. Oct. 2017(accessed).
13 "KPay," https://www.inicis.com/blog/archives/40941, KGInicis corp, Dec. 2014.
14 Bong-sam Beak, "SKT launched T-authentication service for user verification," http://www.zdnet.co.kr/news/news_view.asp?artice_id=20160802083636, ZDNET, Aug. 2016.
15 J. Bonneau, S. Preibusch, and R. Anderson, "A birthday present every eleven wallets? the security of customer-chosen banking pins," In International Conference on Financial Cryptography and Data Security, LNCS 7394, pp. 25-40, Mar. 2012.
16 A. Mahfouz, I. Muslukhov, and K. Beznosov, "Android users in the wild: their authentication and usage behavior," Pervasive and Mobile Computing, vol. 32, pp. 50-61, Oct. 2016.   DOI
17 L. O'Gorman, "Comparing passwords, tokens, and biometrics for user authentication", Proceedings of IEEE, vol. 91, no. 12, pp. 2021-2039, Dec. 2003.   DOI
18 Pyung Kim, Youn-ho Lee, "Performance improvement of the touch stroke dynamics authentication based on free texts," Journal of Korean Institute of Information Technology, 15(4), pp. 45-54, Apr. 2017.
19 "What is the future of wi-fi and mobile?," http://www.ciscokrblog.com/86, Cisco Korea, Aug. 2012.
20 Jae-myung Im, Ji-youl Yoo, Se-jeong Jang, Jeong-hwan Lee, and Jae-min Yoo, "Report on the survey of the user behavior in mobile internet," 32902, KISA, Dec. 2013.
21 M. Harbach, E.V. Zezschwitz, A. Fichtner, A.D. Luca, and M. Smith, " It's a hard lock life: a field study of smartphone (un) locking behavior and risk perception," Symposium on usable privacy and security, pp. 213-230, Jul. 2014.
22 R. Chatterjee, A. Athayle, D. Akhawe, A. Juels, and T. Ristenpart, "Password typos and how to correct them securely," IEEE Symposium on Security and Privacy pp. 799-818, May 2016.
23 Hyper-connected Communication Research Laboratory, "Research on risk analysis on the service use activity and the method for evaluating authentication level," 2011-2016-00046, ETRI, May 2016.
24 J.R.M Filho, and E.O. Freire, "On the equalization of keystroke timing histograms," Pattern Recognition Letters, vol. 27, no. 13, pp. 1440-1446, Oct. 2006.   DOI
25 W. Luo and U. Hengartner, "Proving Your location without giving up your privacy," Proc. ACM 11th Workshop Mobile Computing Systems and Applications, pp. 7-12, Feb. 2010.
26 S. Saroiu and A. Wolman, "Enabling new mobile applications with location proofs," Proc. ACM 10th Workshop Mobile Computing Systems and Applications, pp. 3, Feb. 2009.
27 A. Gupta, M. Miettinen, N. Asokan, and M. Nagy, "Intuitive security policy configuration in mobile devices using context profiling," International Conference on Privacy, Security, Risk and Trust, International Conference on Social Computing, pp. 471-480, Sep. 2012.
28 J. Hu, D. Gingrich, and A. Sentosa, "A k-nearest neighbor approach for user authentication through biometric keystroke dyanmics," Proceedings of the IEEE International Conference on Communications, pp. 1556-1560, May. 2008.
29 D. Gunetti and C. Picardi, "Keystroke analysis of free text," ACM Transactions on Information and System Security (TISSEC) vol. 8, no. 3, pp. 312-347, Aug. 2005.   DOI
30 C. Lobrano, R. Tronci, G. Giacinto, and F. Roli, "Dynamic linear combination of two-class classifiers," Joint IAPR International Workshops on Statistical Techniques in Pattern Recognition and Structural and Syntactic Pattern Recognition, LNCS 6218, pp. 473-482, Aug. 2010.
31 Y. Zhong, Y. Deng, and A. Jain, "Keystroke dynamics for user authentication," Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition Workshops, pp. 117-123, Jun. 2012.
32 A. Messerman, T. Mustafic, S. Ahmet, Camtepe, and S. Albayrak, "Continuous and non-intrusive identity verification in real-time environments based on free-text keystroke dynamics," Proceedings of the International Joint Conference on Biometrics, pp. 1-8, Oct. 2011.
33 A.K. Jain, A. Ross, "Learning user-specific parameters in a multibiometric system," Proceedings of International Conference on Image Processing, pp. 57-60, Sep. 2002.
34 T. Shimshon, R. Moskovitch, L. Rokach, and Y. Elovici, "Continuous verification using keystroke dynamics," Proceedings of the International Conference on Computational Intelligence and Security, pp. 411-415, Dec. 2010.
35 Y. Kaneko, Y. Kinpara, and Y. Shiomi, "A hamming distance-like filtering in keystroke dynamics," Proceedings of the Ninth Annual International Conference on Privacy, Security, and Trust, Montreal, pp. 93-95, Jul. 2011.
36 S. Bleha, C. Slivinsky, and B. Hussein, "Computer-access security systems using keystroke dynamics," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 12, no. 12, pp. 1217-1222, Aug. 1990.   DOI
37 H. Davoudi and E. Kabir, "A new distance measure for free text keystroke authentication," Proceedings of the 14th International Computer Conference, pp. 570-575, Oct. 2009.
38 P.S. Teh, A.B.J. Teoh, C. Tee, and T.S. Ong, "A multiple layer fusion approach on keystroke dynamics," Pattern Analysis and Applications, vol. 14, no. 1, pp. 23-36, Feb. 2011.   DOI
39 T. Hoang, D. Choi, V. Vo, A. Nguyen, and T. Nguyen, "A lightweight gait authentication on mobile phone regardless of installation error," IFIP International Information Security Conference, pp. 83-101, Jul. 2013.
40 M. Trojahn and F. Ortmerier, "Toward mobile authentication with keystroke dynamics on mobile phones and tablets," Advanced Information Networking and Applications Workshops, 27th International Conference on, pp. 697-702, Mar. 2013.
41 P. Tresadern, T.F. Cootes, N. Poh, P. Matejka, A. Hadid, C. Levy, C. McCool, and S. Marcel, "Mobile biometrics: combined face and voice verification for a mobile platform," IEEE Pervasive Computing, vol. 12, no. 1, pp. 79-87, Jun. 2013.   DOI
42 T.Y. Chang, C.J. Tsai, and J.H. Lin, "A graphical-based password keystroke dynamic authentication system for touch screen handheld mobile devices," The Journal of Systems and Software, vol. 85, no. 5, pp. 1157-1165, May 2012.   DOI
43 N. Jeanjaitrong and P. Bhattarakosol, "Feasibility study on authentication based keystroke dynamic over touch-screen devices," Proceeding of 13th International Symposium on Communications and Information Technologies, pp. 238-242, Sep. 2013.
44 N.K. Rantha, Advances in biometrics: sensors, algorithms and systems, Springer, pp. 447-472, Oct. 2007.
45 J. Montalvao Filho and E. Freire, "Multimodal biometric fusionjoint typist (keystroke) and speaker verification," International Telecommunications Symposium, pp. 609-614, Sep. 2006.
46 J. Fierrez-Aguilar, J. Ortega-Garcia, D. Garcia-Romero, and J. Gonzalez-Rodriguez, "A comparative evaluation of fusion strategies for multimodal biometric verification," Audio-and Videobased Biometric Person Authentication, LNCS 2688, pp. 1056-1056, Jun. 2003.
47 H. Saevanee, N.L. Clarke, and S.M. Furnell, "Multi-modal behavioural biometric authentication for mobile devices," In IFIP International Information Security Conference, pp. 465-474, Jun. 2012.
48 Son Do, Thang Hoang, Chuyen Luong, Seung-chan Choi, Do-kyeong Lee, Ki-hyun Bang, and Deok-jai Choi, "Using keystroke dynamics for implicit authentication on smartphone," Transactions on Korea Multimedia Society, 17(8) pp. 968-976, Aug. 2014.   DOI
49 "Using access control in iPhone, iPad, or iPad Touch," https://support.apple.com/ko-kr/HT204060, Apple Inc., Apr. 2017.