Adversary Models for Mobile Device Authentication

Abstract

Mobile device authentication has been a highly active research topic for over 10 years, with a vast range of methods proposed and analyzed. In related areas, such as secure channel protocols, remote authentication, or desktop user authentication, strong, systematic, and increasingly formal threat models have been established and are used to qualitatively compare different methods. However, the analysis of mobile device authentication is often based on weak adversary models, suggesting overly optimistic results on their respective security. In this article, we introduce a new classification of adversaries to better analyze and compare mobile device authentication methods. We apply this classification to a systematic literature survey. The survey shows that security is still an afterthought and that most proposed protocols lack a comprehensive security analysis. The proposed classification of adversaries provides a strong and practical adversary model that offers a comparable and transparent classification of security properties in mobile device authentication.

PresSafe: Barometer-Based On-Screen Pressure-Assisted Implicit Authentication for Smartphones

“…In [30], a dynamic feature selection for hand-writing is developed to enhance the authentication performance. However, these solutions are still not perfect: signals used in these works are generated from biochemical effect [2], [26], [28], which are weak and are not directly measured thus needs a high signal-to-noise ratio environment; or are sent from other devices [27], which face common problems in machine-to-machine authentication, as in [31], [32]. The approaches in [29], [30] heavily rely on online servers and can hardly be performed in an offline manner.…”

GANTouch: An Attack-Resilient Framework for Touch-Based Continuous Authentication System

“…R1: ability to inject data into the authentication pipeline [22], R2: access to the target's biometric samples [24], and R3: reproduction of samples by training imitators (human, machine, or human+machine) in real-time [23]. Based on the amount of effort needed to meet these requirements, ongoing discussion on the Strength of Function for Authenticators by the National Institute of Standards and Technology (NIST) [21], and a recent survey [25], we group the adversarial scenarios into the following three groups.…”

Gone Quishing: A Field Study of Phishing with Malicious QR Codes

“…Most of them were college graduates (60.1%), followed by high school graduates (28.3%), post graduates (10.4%) and only 2% participants with less than a high school education. Age-wise, 45.7% were in the [35][36][37][38][39][40][41][42][43][44] bracket, 24.3% in [25][26][27][28][29][30][31][32][33][34], 13.9% in [45][46][47][48][49][50][51][52][53][54], 9.8% in [55][56][57][58][59][60][61][62][63][64], and 6.4% in [18][19][20][21][22][23][24]. Asked about their QR code usage, 32.4% reported using QR codes "regularly," 56.1% "only when QR codes were preffered" type of information exchange, and 11.6% said "only when QR codes were required.…”

“…Most of them were college graduates (58.1%), followed by high school graduates (32.3%), post graduates (8.9%) and only 0.1% participants with less than a high school education. Age-wise, 44.4% were in the [35][36][37][38][39][40][41][42][43][44] bracket, 24.2% in [25][26][27][28][29][30][31][32][33][34], 12.9% in [45][46][47][48][49][50][51][52][53][54], 15.3% in [55][56][57][58][59][60][61][62][63][64], and 3.2% in [18][19][20][21][22][23][24].…”

“…barcodes) or (ii) Universal Resource Locators (URLs) that, once decoded through users' smartphone camera, enable direct access to websites (e.g. restaurant menus) without the need to type the link themselves [49]. The simplicity of the information piece itself made the QR codes the prefect candidate for manipulation.…”