Understanding user perceptions of transparent authentication on a mobile device

Abstract

Due to the frequency with which smartphone owners use their devices, effortful authentication methods such as passwords and PINs are not an effective choice for smartphone authentication. Past research has offered solutions such as graphical passwords, biometrics and password hardening techniques. However, these solutions still require the user to authenticate frequently, which may become increasingly frustrating over time. Transparent authentication has been suggested as an alternative to such effortful solutions. It utilizes readily available behavioral biometrics to provide a method that runs in the background without requiring explicit user interaction. In this manner, transparent authentication delivers a less effortful solution with which the owner does not need to engage as frequently. We expand the current research into transparent authentication by surveying the user, an important stakeholder, regarding their opinions towards transparent authentication on a smartphone. We asked 30 participants to complete a series of tasks on a smartphone that was ostensibly protected with varying degrees of transparent authentication. We then surveyed participants regarding their opinions of transparent authentication, their opinions of the sensitivity of tasks and data on smartphones, and their perception of the level of protection provided to the data and apps on the device. We found that 90% of those surveyed would consider using transparent authentication on their mobile device should it become available. Furthermore, participants had widely varying opinions of the sensitivity of the experiment's tasks, showing that a more granular method of smartphone security is justified. Interestingly, we found that the complete removal of security barriers, which is commonly cited as a goal in authentication research, does not align with the opinions of our participants. Instead, we found that having a few barriers to device and data access aided the user in building a mental model of the on-device security provided by transparent authentication. These results provide a valuable understanding to inform development of transparent authentication on smartphones since they provide a glimpse into the needs and wants of the end user.

Demystifying Authentication Concepts in Smartphones: Ways and Types to Secure Access

“…However, continuous authentication, active authentication, implicit authentication, and transparent authentication have been interchangeably used in many papers [10,120,131,132]. Patel et al [5] considered continuous authentication and active authentication systems as similar and explained it as continuous monitoring of the user activities after the initial access to the mobile device.…”

“…is concept stresses more on the procedure of collecting and analyzing user authentication identifiers [4,10]. More specifically, if the system performs authentication steps in background (without requiring explicitly user cooperation) [10,31], they are termed as implicit, transparent, or unobtrusive authentication systems.…”

“…More specifically, if the system performs authentication steps in background (without requiring explicitly user cooperation) [10,31], they are termed as implicit, transparent, or unobtrusive authentication systems. However, various authentication types (one-shot, riskbased, or continuous) could collect input transparently.…”

“…risk-based; transparent [3,5,10,113,[119][120][121] [8,12,29,112,113,[115][116][117][122][123][124][125][126][127] end], P, auth}" holding of 3 prime attributes, where "begin" is authorization start date, "end" is either the constant ∞, or a deauthorization date after the start date, "P" is the duration of a session, and "auth" is an authorization function. Feng et al [4] determined that periodic authentication or automatic logouts are more detrimental while one-shot authentication solutions are prone to a wide variety of attacks.…”

“…at modality could be used as standalone or to complement the explicit authentication schemes to enhance their usability [8,9]. More speci cally the concept of transparent authentication is explained as implicitly ngerprinting the user's device interaction logs to authenticate the user [10].…”