EyeVeri: A secure and usable approach for smartphone user authentication

Song, Chen; Wang, Aosen; Ren, Kui; Xu, Wenyao

doi:10.1109/infocom.2016.7524367

Cited by 58 publications

(43 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…(3) The paper had to propose an authentication scheme. Specifically, the paper had to use machine learning to label [12], [33], [41], [42] IMWUT/UbiComp [11], [20], [25], [35], [48] INFOCOM [8], [36], [45], [51], [53] MobiCom [15], [32] MobiSys [7], [31] NDSS [5], [17], [49], [50] Pattern Recognition [2], [9], [18], [24], [38], [40], [54]…”

Section: Review Of Recent Authentication Systemsmentioning

confidence: 99%

Robust Performance Metrics for Authentication Systems

Sugrim

Liu

McLean³

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Research has produced many types of authentication systems that use machine learning. However, there is no consistent approach for reporting performance metrics and the reported metrics are inadequate. In this work, we show that several of the common metrics used for reporting performance, such as maximum accuracy (ACC), equal error rate (EER) and area under the ROC curve (AUROC), are inherently flawed. These common metrics hide the details of the inherent tradeoffs a system must make when implemented. Our findings show that current metrics give no insight into how system performance degrades outside the ideal conditions in which they were designed. We argue that adequate performance reporting must be provided to enable meaningful evaluation and that current, commonly used approaches fail in this regard. We present the unnormalized frequency count of scores (FCS) to demonstrate the mathematical underpinnings that lead to these failures and show how they can be avoided. The FCS can be used to augment the performance reporting to enable comparison across systems in a visual way. When reported with the Receiver Operating Characteristics curve (ROC), these two metrics provide a solution to the limitations of currently reported metrics. Finally, we show how to use the FCS and ROC metrics to evaluate and compare different authentication systems.

show abstract

Section: Review Of Recent Authentication Systemsmentioning

confidence: 99%

Robust Performance Metrics for Authentication Systems

Sugrim

Liu

McLean³

et al. 2019

Proceedings 2019 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…• Once an accepting sample via the feature vector API has been found, it may be possible to obtain an input that results in this sample (after feature extraction), as demonstrated by Garcia et al with the training of an autoencoder for both feature extraction and the regeneration of the input image [23]. • In this work, we have focused on authentication as a binary classification problem, largely because of its widespread use in biometric authentication [8], [9], [10], [11], [12], [13], [14], [15], [16], [26]. However, authentication has also been framed as a one-class classification problem [56], [26] or as multi-class classification [26], e.g., in a discrimination model, as noted earlier.…”

Section: Discussionmentioning

confidence: 99%

“…The target user's data for training is obtained during the registration or enrollment phase. For the negative class, the usual process is to use the data of a subset of other users enrolled in the system [27], [8], [7], [9], [10], [11], [12], [13], [14], [15], [16]. Following best machine learning practice, the data (from both classes) is split into a training and test set.…”

Section: A Biometric Authentication Systemsmentioning

confidence: 99%

On the Resilience of Biometric Authentication Systems against Random Inputs

Zhao¹,

Asghar²,

Kâafar³

2020

Proceedings 2020 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

We assess the security of machine learning based biometric authentication systems against an attacker who submits uniform random inputs, either as feature vectors or raw inputs, in order to find an accepting sample of a target user. The average false positive rate (FPR) of the system, i.e., the rate at which an impostor is incorrectly accepted as the legitimate user, may be interpreted as a measure of the success probability of such an attack. However, we show that the success rate is often higher than the FPR. In particular, for one reconstructed biometric system with an average FPR of 0.03, the success rate was as high as 0.78. This has implications for the security of the system, as an attacker with only the knowledge of the length of the feature space can impersonate the user with less than 2 attempts on average. We provide detailed analysis of why the attack is successful, and validate our results using four different biometric modalities and four different machine learning classifiers. Finally, we propose mitigation techniques that render such attacks ineffective, with little to no effect on the accuracy of the system.

show abstract

“…The inherence factor relies on biometric data, such as fingerprints, user behavior (e.g., behavior on a touchscreen [10] or eye-gaze behavior [33]) and face detection [15]. While biometric authentication can be easy and fast to use, it is accompanied with a number of problems.…”

Section: Inherence Factormentioning

confidence: 99%

GTmoPass

Khamis

Hasholzner

Bulling

et al. 2017

Proceedings of the 6th ACM International Symposium on Pervasive Displays

View full text Add to dashboard Cite

As public displays continue to deliver increasingly private and personalized content, there is a need to ensure that only the legitimate users can access private information in sensitive contexts. While public displays can adopt similar authentication concepts like those used on public terminals (e.g., ATMs), authentication in public is subject to a number of risks. Namely, adversaries can uncover a user's password through (1) shoulder surfing, (2) thermal attacks, or (3) smudge attacks. To address this problem we propose GTmoPass, an authentication architecture that enables Multi-factor user authentication on public displays. The first factor is a knowledge-factor: we employ a shoulder-surfing resilient multimodal scheme that combines gaze and touch input for password entry. The second factor is a possession-factor: users utilize their personal mobile devices, on which they enter the password. Credentials are securely transmitted to a server via Bluetooth beacons. We describe the implementation of GTmoPass and report on an evaluation of its usability and security, which shows that although authentication using GTmoPass is slightly slower than traditional methods, it protects against the three aforementioned threats.

show abstract

EyeVeri: A secure and usable approach for smartphone user authentication

Cited by 58 publications

References 23 publications

Robust Performance Metrics for Authentication Systems

Robust Performance Metrics for Authentication Systems

On the Resilience of Biometric Authentication Systems against Random Inputs

GTmoPass

Contact Info

Product

Resources

About