Authentication schemes for smart mobile devices: threat models, countermeasures, and open research issues

Abstract

This paper presents a comprehensive investigation of authentication schemes for smart mobile devices. We start by providing an overview of existing survey articles published in the recent years that deal with security for mobile devices. Then, we give a classification of threat models in smart mobile devices in five categories, including, identity-based attacks, eavesdropping-based attacks, combined eavesdropping and identity-based attacks, manipulation-based attacks, and service-based attacks. This is followed by a description of multiple existing threat models. We also provide a classification of countermeasures into four types of categories, including, cryptographic functions, personal identification, classification algorithms, and channel characteristics. Therefore, according to the countermeasure characteristic used and the authentication model, we categorize the authentication schemes for smart mobile devices in four categories, namely, 1) biometric-based authentication schemes, 2) channelbased authentication schemes, 3) factors-based authentication schemes, and 4) ID-based authentication schemes. In addition, we provide a taxonomy and comparison of authentication schemes for smart mobile devices in form of tables. Finally, we identify open challenges and future research directions.To conduct the literature review, we followed the same process used in our previous work [14].Specifically, the identification of literature for analysis in this paper was based on a keyword search, namely, "authentication scheme", "authentication protocol", "authentication system", and "authentication framework". By searching these keywords in academic databases such as SCO-PUS, Web of Science, IEEE Xplore Digital Library, and ACM Digital Library, an initial set of relevant sources were located. Firstly, only proposed authentication schemes for smart mobile devices were collected. Secondly, each collected source was evaluated against the following criteria: 1) reputation, 2) relevance, 3) originality, 4) date of publication (between 2007 and 2018), and 5) most influential papers in the field. The final pool of papers consists of the most important papers in the field of mobile devices that focus on the authentication as their objective.Our search started on 01/11/2017 and continued until the submission date of this paper. The main contributions of this paper are:• We discuss the existing surveys on security for smart mobile devices.• We classify the threat models, which are considered by the authentication schemes in smart mobile devices, into five main categories, namely, identity-based attacks, eavesdropping-based attacks, combined eavesdropping and identity-based attacks, manipulationbased attacks, and service-based attacks.• We review existing research on countermeasures and security analysis techniques in smart mobile devices.• We provide a taxonomy and a side-by-side comparison, in a tabular form, of the stateof-the-art on the recent advancements towards secure and authentication schemes in smart mobile devices with respec...

A broad review on non-intrusive active user authentication in biometrics

“…In addition, the gathered behavioural data no need any specific hardware architecture. So it has diminished the cost complexity (Ferrag et al 2020).…”

A mobile app to make biometrics usage more secure

“…Ferrag et al [17] presented authentication schemes of mobile devices into four categories a) factorbased, e.g., 2-Factor, multi-factor, b) channel-based, i.e., Seamless roaming [18] c) ID-based, i.e., remote user's authentication [19] and d) biometric-based.…”

Hybrid Secure Authentication and Key Exchange Scheme for M2M Home Networks

“…If the scheme does not provide security for an attack, then the scheme is classified as not supported. Additionally, this same notation is used in [20][21][22][23].…”