as well. Therefore, the use of the term mobile device should be seen as synonymous with the term smartphone. Specifically excluded from this definition are laptop and desktop computers, e-book readers, and tablet computers.
Identification: determining whether a person is amongst a group of authorized users of a protected resource.
Verification: determining the veracity of a claimed identity.
Keystroke dynamics: a behavioral biometric that uses typing patterns to identify or verify the identity of the typist.
Speaker verification: a behavioral biometric that uses a person’s speech patterns to verify a claimed identity.
Multimodal biometric: a combination of two or more biometric identifiers into a single biometric, with which a decision on identity verification can be based.
2.12
Summary
This chapter has introduced the fundamental concepts that form the basis of this research. It has provided a high–level view of authentication, biometrics and pattern classification, and has defined key terms that will be used throughout this research. The purpose, therefore, has been to provide a strong basis upon which the state-of-the-art research in the field of authen- tication may be built. As such, this chapter has also examined the current research in the field of mobile device authentication, with specific focus on biometrics and transparent authenti- cation. Current work on several physiological and behavioral biometrics was examined, with a focus on how these biometrics relate to authentication on mobile devices. Specific use of behavioral biometrics as transparent authenticators on mobile devices was examined; finally, other frameworks for transparent authentication were reviewed. The findings of the current research in the field of mobile device authentication has provided a basis for the Transparent Authentication Framework presented in this dissertation. This Framework expands upon the current state-of-the-art by providing continuous, transparent mobile device authentication based on behavioral biometrics. It is this Framework that addresses the research question and resultant hypotheses presented in Chapter 1, and thus provides novel work in the field of authentication.
44
Chapter 3
Transparent Authentication
Framework for Mobile Devices
This chapter introduces the main contribution of this research: the Transparent Authentica- tion Framework. The Framework provides a model for designing and developing a trans- parent authentication mechanism to verify the user’s identity on a mobile device; its target audience is mobile device developers. It is intended to be conceptually device and operating system neutral, whether manufacturer or version.
The sections in this chapter cover concepts of device confidence (the level of certainty that the current user is, in fact, the device owner), the data required as input to and the pro- cesses associated with the Framework, and the requirements for the biometrics that may be included. Each section contains a discussion of the rationale for the inclusion or concept, ma- jor elements thereof, and examples of what technology may be used. Since the Framework is intended to be device and software independent, it provides a basis for selecting the best available design choices for provision of a continuous, transparent authentication method on a variety of mobile devices.
3.1
Framework Overview
The Transparent Authentication Framework provides a model for creating an authentication mechanism for mobile devices that goes beyond point-of-entry secret knowledge-based tools such as passwords and PINs. The Framework describes an authentication model that utilizes measurable patterns of device use that can be gathered during its normal functioning. The data collected during execution of these common tasks and the identifiable patterns within them are used to verify the identity of the owner of a mobile device. Presumably, owner verification can also enable access to data and functions. In terms of the three access control
3.1. Framework Overview 45 components introduced in Chapter 2, the Transparent Authentication Framework exists in the convergence of something you have, something you know and something you are. The placement of the Framework in the greater access control field is shown in Figure 3.1.
Something you have Something you know Something you are Physiological Biometrics Bank card Token Password PIN Biometric Passport Bank card w/ PIN Behavioral Biometrics Transparent Authentication Framework
Figure 3.1: Placement of the Transparent Authentication Framework in the access control domain. It resides at the convergence of the three standard access control factors: something you have, something you know and something you are.
This chapter introduces the concept of device confidence as a means of expressing the on- going confidence that the current user is also its owner. Device confidence increases and decreases in response to biometric matches and non-matches. This continually changing measure is mapped to on-device tasks and data. Task confidence is the level set by the owner as the minimum threshold at which access to the task is permitted so that those considered private or sensitive require a higher device confidence to be accessed. The intention is to provide a more nuanced approach to security when compared to binary allowed/not allowed security currently provided by passwords and PINs.
The authentication delivered by this Framework is transparent in that it does not require ex- plicit user interaction. Instead, it takes advantage of uniquely identifying behavioral features available while the owner uses the device. The authentication is also continuous in that it is updated even when the device is not being used. In this way, it goes beyond traditional point–of–entry authentication provided by passwords and PINs, which only protect the de- vice up to the point the secret knowledge is entered. The transparent, continuous nature of this Framework supports flexible, dynamic authentication.
3.1. Framework Overview 46 requested by the owner; for instance, if the owner has only recently begun using the device. To manage these situations, device confidence can be augmented with secondary, explicit authentication methods such as challenge questions, a PIN or password. This secondary method is not all-access; a correct challenge response raises device confidence by incre- ments. This means that access to sensitive information remains possible only at the highest device confidence levels.
The Transparent Authentication Framework addresses implementation concerns for mobile device methods. Such concerns include the required characteristics of included behavioral biometrics, how to combine these into a multimodal biometric for additional security, and al- lowing the device owner to customize options. The Framework includes a process that maps biometric decisions to device confidence, as well as the types of biometrics and classifiers that may be used. Furthermore, this Framework respects device owner privacy since it is designed in such a way that all device owner data remains on the device rather than being processed at a server that then delivers a biometric decision.
The Transparent Authentication Framework uses device confidence, as calculated by bio- metric decisions, to determine what tasks may be completed or data may be accessed. Each task or data is assigned a confidence level either by default or explicitly by the device owner. If the device confidence is greater than or equal to the required task/data confidence, then the device user is allowed to complete the task or access the data. Otherwise, the task or data access is denied and the user must attempt to raise the device confidence. This general flow is shown in Figure 3.2. D e vi ce C o n fid e n ce (% )
Device Use Over Time 100 0 Task- or Data-specific Threshold Explicit Authentication request Est a b lish e d
Bootstrapping Continuous Transparent Auth. Device Unused Pa tt e rn Enrolment
Figure 3.2: Transparent Authentication Framework general flow.
The workflow begins with the device confidence at 0% since the device owner has not yet provided biometrics with which a baseline can be established. The Enrolment phase, seen at the upper left corner of Figure 3.2, precedes the Bootstrapping phase, and allows the owner to provide biometric samples and set initial task confidence levels. Using the Enrolment phase
3.2. Device Confidence 47