Personalized Image-based User Authentication using Wearable Cameras

Abstract

Personal devices (e.g. laptops, tablets, and mobile phones) are conventional in daily life and have the ability to store users' private data. The security problems related to these appliances have become a primary concern for both users and researchers. In this paper, we analyse first-person-view videos to develop a personalized user authentication mechanism. Our proposed algorithm generates provisional image-based passwords which benefit a variety of purposes such as unlocking a mobile device or fallback authentication. First, representative frames are extracted from the egocentric videos. Then, they are split into distinguishable segments before a clustering procedure is applied to discard repetitive scenes. The whole process aims to retain memorable images to form the authentication challenges. We integrate eye tracking data to select informative sequences of video frames and suggest a blurriness-based method if an eye-facing camera is not available. To evaluate our system, we perform experiments in different settings including objectinteraction activities and traveling contexts. Even though our mechanism produces variable graphical passwords, the log-in effort for the user is comparable with approaches based on static challenges. We verified the authentication challenges in the presence of a random and an informed attacker who is familiar with the environment and observed that the time required and the number of attempts are significantly higher than for the legitimate user, making it possible to detect attacks on the authentication system.1 Transcend DrivePro TM Body 10 wearable camera: https://www.transcendinfo.com/Products/No-704

Adversary Models for Mobile Device Authentication

“…Davis, et al [60] further found that (1) user password selection is biased by race and gender [38], thus lowering password entropy, (2) the need for several rounds to provide a reasonably large password space impairs usability, and (3) recognition-based systems are vulnerable to replay attacks [15,264]. It is a research challenge to exploit memorability to improve freshness of authentication challenges [202].…”