Pitfalls in Designing Zero-Effort Deauthentication: Opportunistic Human Observation Attacks

WACA: Wearable-Assisted Continuous Authentication

“…The attacker can either try to bypass the system via providing data from his smartwatch or can try to use the victim's smartwatch somehow obtained (e.g., can steal it or victim can leave it behind). • More Powerful Adversaries: Furthermore, a powerful adversary can be aware of WACA and try to defeat it using special tools and skills by imitating legitimate users [19], [20] or launching statistical attacks [21], [22]. This powerful adversary (insider or outsider) can be a human or a trained bot.…”

“…In this subsection, we evaluate the performance of WACA against two powerful attacks: imitation [19], [20] and statistical [21], [22] attacks. In these attacks, the attacker is aware of WACA and can try to defeat WACA using special tools and skills.…”

“…Zero-effort attacks will not be successful due to the low EER values in WACA as analyzed in the previous sub-sections. However, the effectiveness of the imitation attacks performed by a human should be investigated as noted in some recent studies [19], [20].…”

“…Fortunately, WACA can provide a better solution for these inactive cases. If the smartwatch deployed for data collection has a proximity sensor (or using the Bluetooth signal strengths [20]), the user's closeness to the computer can be checked. If the user moves away, then the user can be logged out.…”

“…(iii) How accurately can it identify an insider? Moreover, we also evaluated the robustness of our proposed method against powerful attacks, including, imitation [19], [20], statistical [21], [22], and insider attacks. Contributions: The main contributions of this work are summarized as follows:…”