Securing Smart Offices Through an Intelligent and Multi-device Continuous Authentication System

Traditional authentication methods, such as passwords and biometrics, verify a user’s identity only at the start of a session, leaving systems vulnerable to session hijacking. Continuous authentication, however, ensures ongoing verification by monitoring user behavior. This study investigates the long-term feasibility of eye-tracking as a behavioral biometric for continuous authentication in virtual reality (VR) environments, using data from the GazebaseVR dataset. Our approach evaluates three architectures—Transformer Encoder, DenseNet, and XGBoost—on short- and long-term data to determine their efficacy in user identification tasks. Initial results indicate that both Transformer Encoder and DenseNet models achieve high accuracy rates of up to 97% in short-term settings, effectively capturing unique gaze patterns. However, when tested on data collected 26 months later, model accuracy declines significantly, with rates as low as 1.78% for some tasks. To address this, we propose periodic model updates incorporating recent data, restoring accuracy to over 95%. These findings highlight the adaptability required for gaze-based continuous authentication systems and underscore the need for model retraining to manage evolving user behavior. Our study provides insights into the efficacy and limitations of eye-tracking as a biometric for VR authentication, paving the way for adaptive, secure VR user experiences.

AuthCODE: A privacy-preserving and multi-device continuous authentication architecture based on machine and deep learning

Existing continuous authentication proposals tend to have two major drawbacks. First, touch-based smartphone authentication approaches typically require explicit user interactions with the smartphone to collect sufficient touch data. These approaches may provide an attacker the opportunity to steal a victim's sensitive data before the system detects the attacker's intrusion. Likewise, an attacker may disable the continuous authentication scheme itself before detection. Second, sensor-based continuous authentication approaches inherently suffer from high energy consumption due to the constant usage of multiple sensors. In this paper, we present a novel continuous authentication system that collects light sensor data from a user's smartphone and analyzes them to authenticate users using support vector machines. We focus on the possibility of collecting light sensor data from users' smartphones while they are conducting daily behaviors to develop an anomaly detection system.

Traditional keyboards remain the input device of choice for typing-heavy environments. When attached to sensitive data, security is a major concern. To continuously authenticate users in these environments, use of keystroke dynamics can be a preferred choice. An integral part of user enrollment in a keystroke based continuous authentication system is the writing instruction (prompt) given to the users, to use as a basis for their improvised writing. There are many prompts possible, and they directly impact the performance of authentication systems. Hence, prompts should be designed carefully, and with purpose. In this paper, we bridge the gap between cognitive psychology and computer science and attempt to influence the mental state of the users to acquire a better authentication performance. We compare two kinds of writing prompts, creative and factual, for generating reference samples. In addition, we perform two robustness tests: robustness to dissimilar writing style (e.g., creative reference and factual test) and robustness to surface (e.g., hard surface reference and soft surface test). We collect data from thirty participants in four weekly sessions. We experiment with three features: key interval, key press, and key hold latencies. We use Relative (R) measure to generate the match score between the reference and test samples. Results show that creative writing consistently performs better than the factual one. Both writing prompts perform well with dissimilar style in testing, i.e., continuous authentication is found robust to writing style. Also, we find that the surface (hard or soft) used in testing need not match that used for the reference, thus continuous authentication is also surface robust.

Continuous authentication systems have been proposed as a promising solution to authenticate users in smartphones in a non-intrusive way. However, current systems have important weaknesses related to the amount of data or time needed to build precise user profiles, together with high rates of false alerts. Voice is a powerful dimension for identifying subjects but its suitability and importance have not been deeply analyzed regarding its inclusion in continuous authentication systems. This work presents the S3 platform, an artificial intelligence-enabled continuous authentication system that combines data from sensors, applications statistics and voice to authenticate users in smartphones. Experiments have tested the relevance of each kind of data, explored different strategies to combine them, and determined how many days of training are needed to obtain good enough profiles. Results showed that voice is much more relevant than sensors and applications statistics when building a precise authenticating system, and the combination of individual models was the best strategy. Finally, the S3 platform reached a good performance with only five days of use available for training the users’ profiles. As an additional contribution, a dataset with 21 volunteers interacting freely with their smartphones for more than sixty days has been created and made available to the community.

Mobile devices can carry large amounts of personal data, but are often left unsecured. PIN locks are inconvenient to use and thus have seen low adoption (33% of users). While biometrics are beginning to be used for mobile device authentication, they are used only for initial unlock. Mobile devices secured with only login authentication are still vulnerable to data theft when in an unlocked state. This paper introduces our work on a face-based continuous authentication system that operates in an unobtrusive manner. We present a methodology for fusing mobile device (unconstrained) face capture with gyroscope, accelerometer, and magnetometer data to correct for camera orientation and, by extension, the orientation of the face image. Experiments demonstrate (i) improvement of face recognition accuracy from face orientation correction, and (ii) efficacy of the prototype continuous authentication system.

AuthConFormer: Sensor-based Continuous Authentication of Smartphone Users Using A Convolutional Transformer

While developing continuous authentication systems (CAS), we generally assume that samples from both genuine and impostor classes are readily available. However, the assumption may not be true in certain circumstances. Therefore, we explore the possibility of implementing CAS using only genuine samples. Specifically, we investigate the usefulness of four one-class classifiers OCC (elliptic envelope, isolation forest, local outliers factor, and one-class support vector machines) and their fusion. The performance of these classifiers was evaluated on four distinct behavioral biometric datasets, and compared with eight multi-class classifiers (MCC). The results demonstrate that if we have sufficient training data from the genuine user the OCC, and their fusion can closely match the performance of the majority of MCC. Our findings encourage the research community to use OCC in order to build CAS as they do not require knowledge of impostor class during the enrollment process.

Explicit authentication of mobile intelligent terminals is easy to be stolen or learned and cannot be continuously authenticated. We propose a continuous privacy protection system based on user habits. By using the touch screen and sensor data in smart mobile terminals, the legitimate users and illegal users of smart mobile terminals are distinguished. By installing applications on mobile intelligent terminals, the system obtains relevant data and uploads them to the cloud server. LSTM algorithm is used to determine behavior types, and CNN-LSTM algorithm is used to extract features and build user feature models. The model is then downloaded to local and updated regularly. If illegal users are detected during the use of smart mobile terminals, measures will be taken to protect the privacy of users. The system effectively realizes an implicit and continuous authentication mode, and effectively protects the privacy of users. Compared with explicit authentication, it has obvious advantages in security, accuracy, stability and total cost control.

Continuous authentication with feature-level fusion of touch gestures and keystroke dynamics to solve security and usability issues

In this chapter, we will provide an overview of EEG biometrics and discuss some of the salient research issues that need to be addressed for making EEG biometric an effective tool for providing information security. We introduce brain signals, especially EEG signals and its analysis methods, before we discuss brainwave biometrics from four aspects, namely the criteria, the elicitation protocols, the feature extraction methods and the classification algorithms. The chapter is then concluded with discussions on how to integrate EEG biometrics with other biometric modalities for continuous authentication, followed by open research questions on the design of EEG-based biometric systems.

Continuous authentication is superior to conventional one-pass authentication by maintaining the security level of a system throughout the entire login session. Leveraging the unique geometric and non-volitional credentials in the cardiac motion, we present a trustworthy, continuous, and non-contact user authentication system. Based on a pilot study with 78 subjects, we evaluate Cardiac Scan in terms of accuracy, authentication time, permanence, and vulnerability. The results show that Cardiac Scan is a robust and usable continuous authentication system.

With the development of the Internet of Things, more and more devices need to be connected to the network. Wireless networks are open, and the network security of devices faces major challenges. The problem of device identification is particularly important. Some traditional signal source marking methods have greatly reduced reliability. The traditional authentication methods mainly rely on software addresses. The radio frequency(RF) fingerprint technology is an emerging device authentication technology, which identifies the device based on the inherent hardware defects of the device itself. The RF fingerprints reflect the inherent characteristics of the device and are difficult to tamper with. In this paper, we proposed an environment invariant feature extraction algorithm based on the cumulative distance. The experiments show that the algorithm proposed in this paper has good robustness. Within the allowable error range, the extracted RF fingerprint features of the same signal in different frequencies, different receivers, and different environments are invariant.KeywordsMarking methodsRF fingerprintI/Q data

Continuous authentication offers the ability to continuously verify users' identity for accessing to the protected resource. Although current explorations such as face and fingerprint verification have seen varying rates of success, three main problems may limit their applicability in the context of information protection and access control: they can be of low availability in some practical scenarios, they can be intrusive, and they commonly require costly equipment. This paper presents a multimodal biometrics authentication system that can continuously verify the presence of a logged-in user. Three passive biometric modalities are currently used - keystroke (i.e., behavioral biometric), face (i.e., physiological biometric), and skin color (i.e., soft biometric) - but our approach can also be readily extended to include more modalities. By fusing these three passive biometrics, the continuous authentication system combines both temporal and modality information holistically, and can keep verifying who is using the computing system, without troubling users' routine activities. Based on real data resulting from our implementation, we find the results to be very promising with a false-acceptance rate of 0% and a false-rejection rate of 0.72%. Additional experiment on the size of observation window is provided to further examine the applicability of the proposed approach.

Session authentication schemes establish the identity of the user only at the beginning of the session, so they are vulnerable to attacks that tamper with communications after the establishment of the authenticated session. Moreover, smartphones themselves are used as authentication means, especially in two-factor authentication schemes, which are often required by several services. Whether the smartphone is in the hands of the legitimate user constitutes a great concern, and correspondingly whether the legitimate user is the one who uses the services. In response to these concerns, Behavioral Biometrics (BB) Continuous Authentication (CA) technologies have been proposed on a large corpus of literature. This paper presents a research on the development and validation of a BBCA system (named BioPrivacy), that is based on the user’s keystroke dynamics, using a Multi-Layer Perceptron (MLP). Also, we introduce a new behavioral biometrics collection tool, and we propose a methodology for the selection of an appropriate set of behavioral biometrics. Our system achieved 97.18% Accuracy, 0.02% Equal Error Rate (EER), 97.2% True Acceptance Rate (TAR) and 0.02% False Acceptance Rate (FAR).KeywordsMachine learningBehavioral biometricsContinuous authenticationMobile devicesMulti-layer perceptron (MLP)