Surveying Biometric Authentication for Mobile Device Security

Mobile phone touch screen devices are equipped with high processing power and high memory. This led to users not only storing photos or videos but stored sensitive application such as banking applications. As a result of that the security system of the mobile phone touch screen devices becomes sacrosanct. The application of machine learning algorithms in enhancing security on mobile phone touch screen devices is gaining a tremendous popularity in both academia and the industry. However, notwithstanding the growing popularity, up to date no comprehensive survey has been conducted on machine learning algorithms solutions to improve the security of mobile phone touch screen devices. This survey aims to connect this gap by conducting a comprehensive survey on the solutions of machine learning algorithms to improve the security of mobile phone touch screen devices including the analysis and synthesis of the algorithms and methodologies provided for those solutions. This article presents a comprehensive survey and a new taxonomy of the state-of-the-art literature on machine learning algorithms in improving the security of mobile phone touch screen devices. The limitation of the methodology in each article reviewed is pointed out. Challenges of the existing approaches and new perspective of future research directions for developing more accurate and robust solutions to mobile phone touch screen security are discussed. In particular, the survey found that exploring of different aspects of deep learning solutions to improve the security of mobile phone touch screen devices is under-explored.

This paper addresses the implementation of an eye detection mobile application for unlocking mobile devices using its built camera as an eye tracker. The implementation allows a real-time face and eye detection of a mobile phone user. The idea behind our development was the creation of a preventive model for the benefit and safety of mobile users, including disabled users (e.g., users with arthritis). The product is a visual application that detects the pupils and can simulate the mouse cursor on the screen to unlock the device. Although some screen lock methods have been already developed, our project aims to complement the security in mobile devices. Moreover, with a new mechanism to unlock mobile devices it would offer a more robust alternative in terms of safety of such devices. Evaluation results suggest our implementation is a promising alternative for security in these devices.

The competency to use mobile devices for work-related tasks gives advantages to the company productiveness and expedites business processes. Thus Bring Your Own Device (BYOD) setting emerge to enable work flexibility and technological compatibility. For management, employees’ productivity is important, but they could not jeopardise the security of information and data stored in the corporate network. Securing data and network becomes more complex tasks as it deals with foreign devices, i.e., devices that do not belong to the organisation. With much research focused on pre-implementation and the technical aspects of mobile device usage, post-implementation advancement is receiving less attention. IS audit as one of the post-implementation mechanisms provides performance evaluation of existing IS assets, business operations and process implementation, thus helping management formulating the best strategies in optimising IS practices. This paper discusses the feasibility of IS audit in assessing mobile device security by exploring the risks and vulnerabilities of mobile devices for organisational IS security as well as the perception of Information system management in mobile device security. By analysing related literature, authors pointed out how the references used in the current IS audit research address the mobile device security. This work serves a significant foundation in the future development in mobile device audit.

The Second Usable Privacy and Security for Mobile Devices Workshop (U-PriSM 2) was held with MobileHCI'13. The U-PriSM 2 workshop was an opportunity for researchers and practitioners to discuss research challenges and experiences around the usable privacy and security of mobile devices (smart phones and tablets). Security often involves having non-security experts, or even novice users, regularly making important security decisions while their main focus is on other primary tasks. This is especially true for mobile devices where users can quickly and easily install apps, where user interfaces are minimal due to space constraints, and where users are often distracted by their environment.Participants had a chance to explore mobile device usage and the unique usable security and privacy challenges that arise, discuss proposed systems and ideas that address these needs, and work towards the development of design principles to inform future development in the area.

The security of mobile devices has become an increasingly important issue especially for the mobile-payment application. Iris recognition is an emerging technology for mobile authentication owing to its high uniqueness and distinctiveness. However, it is a challenging problem because iris images acquired by mobile devices generally have low-quality and the computational resources of mobile devices are limited. In order to track the state-of-the-art algorithms in iris recognition on mobile devices under near infra-red (NIR) illumination, we organized the BTAS Competition on Mobile Iris Recognition (or MIR2016 shortly), which is the first mobile iris recognition competition of NIR images as far as we know. All the participants have to strictly comply with the evaluation protocol to assure fairness. In this competition, three participants submitted six algorithms in total and five algorithms from two participants were qualified. The submitted algorithms were trained on the newly constructed MIR-Train database and evaluated on the unpublished MIR-Test database. We rank the submitted algorithms by the evaluated results in terms of False Non-match Rate (FNMR) when False Match Rate (FMR) is 0.0001.

Increasing attention to digital identity and self-sovereign identity (SSI) is gaining momentum. SSI brings various benefits to natural persons, such as owning controls; conversely, digital identity systems in the real world require Sybil-resistance to comply with anti-money laundering (AML) and other needs. CanDID by Maram et al. proposed that decentralized digital identity systems may achieve Sybil-resistance and preserve privacy by utilizing multi-party computation (MPC), assuming a distributed committee of trusted nodes. Pass et al. proposed the formal abstraction of attested execution secure processors (AESPs) while equipping hardware-assisted security in mobile devices has become the norm. We first describe our proposal to utilize AESPs for building secure Sybil-resistant SSI systems, the architecture with a set of system protocols <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\Pi ^{{\mathcal {G}}_{\mathtt {att}}}$ </tex-math></inline-formula>, which brings drastic flexibility and efficiency compared to existing systems. In addition, we propose a novel scheme that enables users (holders) to request verifiers to verify their credentials without AESPs, and it further achieves unlinkability among credentials created for public verification. Our scheme introduces a simplified format for computed claims and commitment-based anonymous identifiers. We also describe a technique to utilize zero-knowledge membership proofs, in particular, “One-Out-of-Many Proofs” <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\Sigma $ </tex-math></inline-formula>-protocol by Groth and Kohlweiss, which can prove the existence of an expected credential without identifying it. Along with other techniques, such as utilizing the BBS+ signature scheme, we demonstrate how our scheme can achieve its goals with the extended anonymous and Sybil-resistant SSI system protocols <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\Pi ^{{\mathcal {G}}_{\mathtt {att}}+}$ </tex-math></inline-formula>. Entitling unlinkability among derived credentials in the anonymous Sybil-resistant SSI results in proper privacy preservation.

Residential Network is an inter-connection of several electrical and electronic home appliances for convenient, comfortable and daily life of home users. It is the hybrid technology of wireless, Ethernet, Bluetooth and RF to the internet via broadband connection at home with various home network services regardless of device, time and place. More and more devices will be wireless and most of them will be roaming in growing ubiquitous technology. The interaction among the roaming devices of residential network must be secure because these roaming devices carry private information of daily life of residential users. This paper presents security of roaming devices of residential network using integration of Mobile IP and IP Security at residential gateway for stronger security of roaming devices in foreign residential networks. Moreover, a secure Mobile IP registration protocol is proposed based on asymmetric cryptography for roaming security of mobile residential devices in foreign networks.

Mobile devices such as smartphones and tablets are widely used for personal and business uses. Compared to personal mobile subscribers, enterprises have more concerns about mobile device security. The challenges an enterprise may face include unlimited access to corporate resources, lack of encryption on corporate data, unwillingness to backup data, etc. Many of these issues have been resolved by auditing and enforcing security policies in enterprise networks. However, it is difficult to audit and enforce security policies on mobile devices. A substantial discrepancy exists between enterprise security policy administration and security policy enforcement. In this paper, we propose a framework, MobileGuardian, for security policy enforcement on mobile devices. Security policy enforcement is further divided into four issues, i.e., sensitive data isolation, security policy formulation, security policy testing, and security policy execution. The proposed framework is secure, flexible, and scalable. It can be adopted on any mobile platforms to implement access control, data confidentiality, security, and integrity.

“Essential Security Practices for Fortifying Mobile Apps” is a definitive guide designed to empower developers, security professionals, and organizations with the knowledge and tools needed to secure mobile applications in an increasingly complex digital landscape. This comprehensive book covers every aspect of mobile app security, providing actionable insights and practical strategies to protect apps from the ever-evolving threat landscape. The book begins with an Introduction to Mobile App Security (Chapter 1), where readers are introduced to the critical importance of securing mobile apps. It discusses common security threats, the principles of security by design, and the unique challenges faced in mobile app development. The chapter also includes case studies of major security breaches, offering real-world context to the concepts discussed. In Secure Development Lifecycle (Chapter 2), the book emphasizes the importance of integrating security into the Software Development Lifecycle (SDLC). Topics such as threat modeling, secure coding practices, and penetration testing are explored in depth. This chapter also covers the role of continuous integration in maintaining security and the necessity of incident response planning and security training. Authentication and Authorization (Chapter 3) dives into the mechanisms that ensure only authorized users have access to mobile apps. It covers secure authentication methods, including multi-factor authentication and token-based authentication, as well as best practices for session management and password storage. The chapter provides guidelines to avoid common authentication flaws that could compromise app security. Data Protection and Privacy (Chapter 4) addresses the crucial aspects of encrypting data both at rest and in transit. It discusses secure data storage, privacy by design principles, and the handling of personally identifiable information (PII). Readers will learn about secure data deletion and compliance with data protection regulations, as well as the use of secure cryptographic libraries. Network Security (Chapter 5) explores the protocols and techniques needed to secure communication between mobile apps and their backend systems. The chapter covers the correct use of TLS/SSL, protecting against man-in-the-middle attacks, and securing backend APIs. It also discusses the importance of monitoring and logging network activity to detect and respond to potential threats. The book then moves on to Secure Coding Practices (Chapter 6), providing guidance on avoiding common coding vulnerabilities through input validation, error handling, and defensive programming techniques. It also covers secure code reviews and the best practices for using mobile platform APIs securely. Mobile Device Security (Chapter 7) shifts focus to the security of the devices on which mobile apps run. The chapter discusses mobile device threats, secure device configuration, and the use of mobile device management (MDM) solutions. It also addresses the security features of mobile devices, such as secure boot and remote wiping, which are essential for protecting against device theft or loss. In Secure Deployment and Distribution (Chapter 8), readers will learn about secure strategies for deploying and distributing mobile apps. Topics include code signing, protecting against repackaging and tampering, and securely distributing sensitive data. The chapter also covers handling updates and patches, ensuring that apps remain secure after deployment. Security Testing and Validation (Chapter 9) provides an in-depth look at the various types of security testing, including automated and manual testing techniques. It discusses penetration testing best practices, vulnerability assessment, and the integration of security testing into CI/CD pipelines. Regular security audits and addressing found vulnerabilities are also emphasized. Incident Response and Management (Chapter 10) guides readers in building an effective incident response team and creating a robust incident response plan. The chapter covers the steps for detecting, analyzing, containing, eradicating, and recovering from security incidents. Post-incident analysis and communication with stakeholders are also discussed, alongside legal and regulatory considerations. Finally, Future Trends in Mobile App Security (Chapter 11) explores the emerging threats and advancements in mobile security technologies. The chapter discusses the role of artificial intelligence in security, the integration of IoT with mobile devices, and the potential of blockchain in enhancing mobile security. It also highlights the importance of user education and awareness in safeguarding mobile applications in the future. “Essential Security Practices for Fortifying Mobile Apps” is an invaluable resource for anyone involved in the development, deployment, and management of mobile applications, offering a thorough understanding of the security challenges and the strategies needed to overcome them.

The article focuses on studying and implementing a method of assigning access rights to the applications in a corporate mobile network with different requirements for security, which will allow considering the specific activities of multiple users. The existing solutions for assigning access rights to applications and services of the intranet are analyzed, the need to create a method that ensures information security when implementing access in corporate networks with different requirements for the level of security is substantiated. Due to the results of analysis of trends and development prospects of modern corporate mobile networks there has been found a contradiction between the requirements for information security of universal mobile devices with access to secure services and technical capabilities of information security systems that ensure access security in the corporate networks with different security requirements. To solve the problem, a multi-user system has been implemented that ensures operation of any computer equipment and mobile devices of an organization whose DBMS has a client-server architecture. The functional requirements for the developed method include the ability to perform user authorization, providing the administrator with the ability to manage user access rights to various applications, managing application storage, recording user operations, and keeping records. In the course of the software implementation of the method of assigning access rights, the design of the database is described in stages, a model of information flows is built, a physical diagram of the interaction of individual procedures is considered, on the basis of which the database is created, a user interface with forms that display information stored in the database is developed.

ARM TrustZone has become a cornerstone of security in mobile edge devices, but its protective measures often come at the expense of energy efficiency and system performance. Existing optimization methods rely heavily on cloud-based deep learning models and real-time measurements, making them vulnerable to fluctuating workloads and variable network conditions. This paper introduces a novel offline tuning framework for optimizing Trusted Applications (TAs) within the Open Portable Trusted Execution Environment (OP-TEE), an open-source TEE built on ARM TrustZone. Unlike traditional approaches, our method dispenses with on-device measurements and repeated TA compilations. Instead, it uses a predictive model trained on runtime characteristics observed in the Rich Execution Environment (REE) to estimate energy and performance metrics. Guided by these predictions, the framework then applies targeted optimizations through an automated tuning mechanism. Experimental results show that this offline approach accelerates the tuning process by 196× compared to the default method, while delivering a 27.23% performance improvement and a 25% reduction in energy consumption within just 170 s. These gains underscore the practicality and effectiveness of the proposed framework, paving the way for more efficient and adaptive TA optimization.

Nowadays, most mobile applications rely on device screen locking mechanisms for ensuring practical security, which expects the users to explicitly authenticate with a PIN or biometric irrespective of the perceived threats. Owing to this usability issues, many avoid using device locks potentially compromising the security. To overcome the limitations of this binary approach, we present an implicit authentication framework called PRISM (Policy-driven Risk-based Implicit locking for improving the Security of Mobile end-user devices). It provides risk based authentication by detecting anomalies in the usual behavior patterns of the users which include their expected locations, activities and application usage. Its device unlocking decisions are driven by policies that are defined either automatically by mining sensor data or manually by the end-users. Our experiments show that PRISM is able to discover useful behavior patterns efficiently even with limited data. The number of required explicit authentications is significantly reduced while assuring the preferred security for everyday scenarios.

The ever-increasing use of mobile devices for communication and entertainment has made these devices an increasingly attractive target for malicious attacks. Thus, mobile device security has emerged as an important research area. Although malicious exploits for mobile phones have been steadily developing over the last decade, the emergence of smart-phone technology is proving to be a turning point in development of such malicious exploits. With the increase in sophistication of smartphones and their use for day-today activities, mobile threats (e.g., viruses, spyware, and malware) has also increased. This trend can be attributed to the fact that phone users want to communicate, and viruses want to be communicated. This chapter presents a state-of-the-art review of the developments in this important field of mobile malware.

This chapter surveys security of mobile computing devices with focus on multimedia applications. Mobile computing devices are handheld devices such as PDAs (personal digital assistants) and smartphones with smaller size, processing, storage, and memory capacity compared to PCs (personal computers). The portability and various wireless network connection interfaces of the handheld devices greatly increase the risks of loss and theft of the device, exposure of confidential data, as well as the opportunities for unauthorized device, network, and network service access. The initial part of the chapter concentrates on discussing these basic security issues. Security requirements for wired and mobile multimedia network applications are outlined and network protocols (SIP, SRTP) for secure multimedia streaming services are presented. Mobile device security can be based on IPSec VPN technology and secure mobility is especially important in videoconferencing. Current research on roaming security and testbeds for mobile multimedia are also presented. In an appendix, commercially available mobile security solutions, mostly for basic mobile security requirements, are listed.

Security risks, requirements, and security policies have all changed in the new mobile environment. The authentication for mobile communications networks techniques has piqued academic and business interest as an issue for mobile communications evolution. Research about mobile security has turned into a research hotspot. This paper conducts a systematic review, which is a technique to evaluate, interpret and locate all accessible research materials to answer the specific research question. This review was carried out in three stages: planning the data source and search string, conducting the study selection, and then reporting the results of the review. According to the analysis of the selected primary studies, current Mobile Device Security research focuses on four issues and trends: malware and intrusion detection, cryptography, authentication, and information invasion. Of the four focuses, it can be said that the method most frequently encountered and used is artificial intelligence. In addition, 60.61 percent of research papers utilized public datasets, whereas 39.39 percent used private datasets. This research has contributed to the academic and practical side and can guide future research or system development related to Mobile Device Security.