Assentication: User De-authentication and Lunchtime Attack Mitigation with Seated Posture Biometric

Abstract

Biometric techniques are often used as an extra security factor in authenticating human users. Numerous biometrics have been proposed and evaluated, each with its own set of benefits and pitfalls. Static biometrics (such as fingerprints) are geared for discrete operation, to identify users, which typically involves some user burden. Meanwhile, behavioral biometrics (such as keystroke dynamics) are well-suited for continuous, and sometimes more unobtrusive, operation. One important application domain for biometrics is de-authentication: a means of quickly detecting absence of a previously-authenticated user and immediately terminating that user's active secure sessions. De-authentication is crucial for mitigating so-called Lunchtime Attacks, whereby an insider adversary takes over (before any inactivity timeout kicks in) authenticated state of a careless user who walks away from her computer.Motivated primarily by the need for an unobtrusive and continuous biometric to support effective de-authentication, we introduce PoPa -a new hybrid biometric based on a human user's seated posture pattern. PoPa captures a unique combination of physiological and behavioral traits. We describe a low-cost fully functioning prototype that involves an office chair instrumented with 16 tiny pressure sensors. We also explore (via user experiments) how PoPa can be used in a typical workplace to provide continuous authentication (and de-authenication) of users. We experimentally assess viability of PoPa in terms of uniqueness by collecting and evaluating posture patterns of a cohort of users. Results show that PoPa exhibits very low false positive, and even lower false negative, rates. In particular, users can be identified with, on average, 91.0% accuracy. Finally, we compare pros and cons of PoPa with those of several prominent biometric-based de-authentication techniques.

De-Authentication Using Ambient Light Sensor

“…Given the significance of user de-authentication to prevent lunchtime attacks, different mechanisms have been proposed that aim at continuously establishing the user's presence/absence near the system. Kaczmarek et al [2] propose Assentication to profile user's sitting posture. In particular, Assentication installs 16 pressure sensors in an office chair to capture a hybrid biometric trait by combining user's behavioral and physiological characteristics.…”

“…If the user wants to leave her computer for whatever reason during this period, her currently active session must be locked/logged out; especially in shared workspace settings. Failure to do so can lead to lunchtime attacks [1], [2], where an adversary (typically an insider) gains access to the user's running session and engages in potentially undesirable activities.…”

“…The state-of-the-art solutions (cf. Section II) require external equipments [1], [2], [6]- [11], are relatively expensive [1], [2], [9], [11], need physical customization or specific installation [1], [2], [7], [8], [12], are complex to deploy [2], [6], [7], involve regular maintenance [2], [8]- [10], or sometimes cause inconvenience to the user [6], [9]- [11]. Such limitations hinder a broader adoption of the existing solutions.…”

Privacy-Friendly De-authentication with BLUFADE: Blurred Face Detection

“…FADEWICH [8] instruments an office with position sensors to detect whether the users are sitting at their desks. Assentication [22] detects user presence through pressure sensors in the chair cushion. Whereas, [10] instruments a chair with BLE beacons to detect whether the user is currently sitting.…”

Location-based Behavioral Authentication Using GPS Distance Coherence

“…Besides using human-smartphone interactions, multimodal authentication also uses other factors. T. Kaczmarek et al [27] investigated a new hybrid biometric based on a human users seated posture pattern in an average office chair over the course of a typical workday. Their experimental results on a population of 30 users showed that the posture pattern biometric can capture a unique combination of physiological and behavioral traits and can authenticate the users with 91% of accuracy.…”