Design and Implementation of a Contextual-Based Continuous Authentication Framework for Smart Homes

Abstract

There has been a rapid increase in the number of Internet of Things (IoT) devices in the last few years, providing a wide range of services such as camera feeds, light controls, and door locks for remote access. Access to IoT devices, whether within the same environment or remotely via the Internet, requires proper security mechanisms in order to avoid disclosing any secure information or access privileges. Authentication, on which other security classes are built, is the most important part of IoT security. Without ensuring that the authorized party is who it claims to be, other security factors would be useless. Additionally, with the increased mobility of IoT devices, traditional authentication mechanisms, such as a username and password, are less effective. Numerous security challenges in the IoT domain have resulted in the proposal of many different approaches to authentication. Many of these methods require either carrying an authentication token, such as a smartcard, or restricting access to a particular physical location. Considering that most IoT devices contain a wide array of sensors, a large amount of contextual information can be provided. Thus, real-time security mechanisms can protect user access by, for example, utilizing contextual information to validate requests. A variety of contextual information can be retrieved to strengthen the authentication process, both at the time of access request and throughout the entire access session, without requiring user interaction, which avoids the risk of being discovered by attackers of these features. In this paper, we introduce a continuous authentication framework that integrates contextual information for user authentication in smart homes. The implementation and evaluation show that the framework can protect smart devices against unauthorized access from both anonymous and known users, either, locally or remotely, in a flexible manner and without requiring additional user intervention.

A Robust Device-to-Device Continuous Authentication Protocol for the Internet of Things

“…According to the user's authentication policy, he/she will attain the authorization policy to access devices and locations. Another framework for smart homes is presented by Ashibani et al [18]. It provides continuous authentication based on contextual information.…”

“…Several authors proposed continuous authentication, and mainly focused on authenticating user-to-device (U2D), e.g., [15], [16], [17], [18], etc. Therefore, this research focuses on continuous authentication between devices referred to as device-to-device (D2D), where devices deal with and communicate with each other in the IoT environment.…”

“…The device's features should be carefully selected to improve the authentication process. Moreover, the use of multiple features or contextual information to authenticate users would increase the reliability and security of the authentication process [18].…”

A Multi-Feature User Authentication Model Based on Mobile App Interactions

“…a PIN or password) and will be used at and beyond the login stage on the mobile device. This approach can be integrated as a second layer of authentication and identification in an implemented framework [36]. In this framework, a central controller hub, namely a smart home server that functions as the network controller, is responsible for user registration, authentication, and identification as well as feature collection and extraction.…”

PALOT: Profiling and Authenticating Users Leveraging Internet of Things

“…User profiles are then dynamically updated over time, thus guaranteeing the adaptability of the entire procedure. Another continuous authentication framework was detailed in [35], integrating contextual information for user authentication in smart homes. The framework proposed by the authors models behavioral profiles based on how users behave or what they do.…”