No abstract

The growing trend of using smartphones as personal computing platforms to access and store private information has stressed the demand for secure and usable authentication mechanisms. This paper investigates the feasibility and applicability of using motion-sensor behavior data for user authentication on smartphones. For each sample of the passcode, sensory data from motion sensors are analyzed to extract descriptive and intensive features for accurate and fine-grained characterization of users’ passcode-input actions. One-class learning methods are applied to the feature space for performing user authentication. Analyses are conducted using data from 48 participants with 129,621 passcode samples across various operational scenarios and different types of smartphones. Extensive experiments are included to examine the efficacy of the proposed approach, which achieves a false-rejection rate of 6.85% and a false-acceptance rate of 5.01%. Additional experiments on usability with respect to passcode length, sensitivity with respect to training sample size, scalability with respect to number of users, and flexibility with respect to screen size were provided to further explore the effectiveness and practicability. The results suggest that sensory data could provide useful authentication information, and this level of performance approaches sufficiency for two-factor authentication on smartphones. Our dataset is publicly available to facilitate future research.

No abstract

A wealth of sensors on smartphone has greatly enriched people's life, but these sensors also brought potential security problems since they allow third-party applications to monitor the motion changes of smartphones. This paper presents an empirical study of analyzing the characteristics of accelerometer and magnetometer data collected from third-party applications to infer user inputs on smartphone. Specifically, an installed application was run as a background process to monitor the data of motion sensors. Accelerometer data was analyzed to detect the occurrence of touch tap actions. Then the accelerometer data and magnetometer data were combined together to build a model for inferring the tap position on touchscreen. Along with common layouts of keyboard or number pad, one can easily obtain users' inputs. Results indicated that users' inputs could be accurately inferred from the data of motion sensors, with the accuracies of 100% and 80% for tap-action detection and input inference in some cases. We conclude that readings from motion sensor are a powerful side channel for inferring user inputs, and could provide extra avenues for attackers.

No abstract