A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones

Abstract

Mobile user authentication acts as the first line of defense, establishing confidence in the claimed identity of a mobile user, which it typically does as a precondition to allowing access to resources in a mobile device. NIST states that password schemes and/or biometrics comprise the most conventional user authentication mechanisms for mobile devices. Nevertheless, recent studies point out that nowadays password-based user authentication is imposing several limitations in terms of security and usability; thus, it is no longer considered secure and convenient for the mobile users. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Alternatively, biometric-based user authentication has gained attention as a promising solution for enhancing mobile security without sacrificing usability. This category encompasses methods that utilize human physical traits (physiological biometrics) or unconscious behaviors (behavioral biometrics). In particular, risk-based continuous user authentication, relying on behavioral biometrics, appears to have the potential to increase the reliability of authentication without sacrificing usability. In this context, we firstly present fundamentals on risk-based continuous user authentication, relying on behavioral biometrics on mobile devices. Additionally, we present an extensive overview of existing quantitative risk estimation approaches (QREA) found in the literature. We do so not only for risk-based user authentication on mobile devices, but also for other security applications such as user authentication in web/cloud services, intrusion detection systems, etc., that could be possibly adopted in risk-based continuous user authentication solutions for smartphones. The target of this study is to provide a foundation for organizing research efforts toward the design and development of proper quantitative risk estimation approaches for the development of risk-based continuous user authentication solutions for smartphones. The reviewed quantitative risk estimation approaches have been divided into the following five main categories: (i) probabilistic approaches, (ii) machine learning-based approaches, (iii) fuzzy logic models, (iv) non-graph-based models, and (v) Monte Carlo simulation models. Our main findings are summarized in the table in the end of the manuscript.

Identifying the Mutual Correlations and Evaluating the Weights of Factors and Consequences of Mobile Application Insecurity

“…The vulnerabilities of mobile applications (authentication and authorization errors, data leakage, etc.) and their security risks (API vulnerabilities, weak authorization and According to [17,18], when it comes to mobile App security, the main problems that occur the most frequently are improper platform usage, insecure data storage, insecure client-server communication, insecure authentication (for example, the password authentication of users imposes a number of restrictions and is no longer considered safe and convenient for mobile users, while biometric authentication of users has recently attracted increasing attention as a promising solution for improving mobile security [19,20]), insecure authorization, insufficient data encryption, poor code quality, code tampering, reverse engineering risk, and extraneous functionality. The frequency of these precedents impact on the security of mobile applications is shown in Figure 1 (on the basis of the OWASP Mobile Top 10 Risks from 2018 [17,18], because the new Mobile Top 10 Risks list for 2023 is being worked upon, as indicated on the official OWASP website).…”