Seamless and Strong Authentication on Mobile Devices Based on User Activity - Perez, Luís Paulo Lemos (2015)
In 2015, the number of mobile devices (e.g., smartphones, tablets, phablets, etc.) exceeded the number of physical computers worldwide. The physical characteristics of these devices are constantly evolving. Increased autonomy, storage and processing capacity, as well as functionality are factors that lead people to buy more and more of these devices. There are thousands of applications for many different areas, that can be can be installed and used on daily-basis, ranging from finantial applications, to health, games, movies, and utilities, etc. Users increasingly rely on these devices, entrusting them with private or sensitive data (e.g., photos, contacts, videos, confidential information, etc.). Thus, the system must be ever safer, so that the users also feel safer when using them. Android is an open source Operating System (OS), for which is simple to develop applications. At the time of writing of this dissertation, this was the most widely used OS in the world of mobile devices. and users rely on its security mechanisms to protect them against attacks from third parties. In addition to the security mechanisms functioning without the explicit knowledge of the user, it is possible to use other optional security application such as lock screens with associated secret. The lock screen applications are authentication systems that allows one to block and control the access to the device. The authentication is the process by which an entity (e.g., a person or a system) is identified by another entity. The authentication process is usually achieved by proving knowledge or possession of a personal characteristic or device, which are known as something you have, something you have or something you are factors. These designations that are typically used to categorize authentication mechanisms. Several factors can be combined in multi-factor systems to increase security. One of the problems of lock screens and current authentication systems is that, regardless of the concept being used, the secret code to unlock or to authenticate to the system is always static along the time. This specific characteristic of the current approaches can be exploited by malicious users. If the authentication secret (e.i., the code of a lock screen application) is discovered, and the user is unaware of this fact, then the malicious user who discovered the secret can log in afterwards and impersonating the real user, because the system always asks for the same secret code. If the user wants to avoid the aforementioned situation while using the popular authentication systems based on username-password or patterns, he has the inconvenience of having to change and memorize a new authentication secret regularly. This master’s program consisted in the development and analysis of a new approach for authentication in which the secret is dynamic, which means that it changes over time without the direct intervention of the user. One of the main objectives that are expected from this approach is that it conciliates security with user friendliness. The user is not forced to change the secret nor has to explicitly memorize it in the same way he memorizes a password, Personal Identification Number (PIN), image, pattern, etc. In the proposed approach, the authentication system uses the activity of the user on the mobile device to generate the secret that enables unlocking it and identify the user. The data concerning user activity is stored by the OS itself. This authentication method is simple, because it is based in information that the user knows without much effort, and it is safe, because the authentication secret is not static, contrarily to many authentication mechanisms used nowadays. To test the feasibility of the authentication approach, it was decided to proceed with the preparation of a survey to obtain feedback from users on different aspects. The survey was done in digital format and used also a mobile application for the Android operating system, specially designed for the subject at hands. The survey was divided into three parts. The first part contained questions about knowledge and safety habits in the utilization of smartphones, and also questions related to the main topic of this master’s program. The second part of the survey contained a usability test. In this test, several challenge-questions related with the activities of the participant on your smartphone were asked, namely questions about the most recent calls and messages. Usability testing was divided into four groups, with three questions each: one on the contact name associated with incoming or outgoing calls; one on the duration of calls and the another one on the name associated with the most recent messages. In the final part of the survey, the questions were designed so as to obtain the opinion of the user regarding the proposed approach and the subject of the dissertation. After the delivery of the survey results, progress was made to analyze the results. After having obtained enought users participating in the survey, the results were analysied. Several individual and comparative analysis were performed at this stage. It was concluded that users remember information about contact names more easely, both for calls and for messages, and that they find it more difficult to memorize the duration of calls. Participants were faster answering to questions related with messages than related with calls. Through this survey and its results, it was possible to evaluate and analyze various other aspects, such as the kind of activity the user is more aware of (e.g., last vs. penultimate activities), or the impact on effectiveness of the number of options displayed for every question. Most participants found the approach to be very interesting. Apart from what was mentioned before, the most visible outcome of this work is the final prototype for a lock screen, which offers two modes of operation. In the first version, the user must correctly answer a consecutive series of questions to unlock the smartphone. In the second version, several contact names are displayed on the screen, and the user has to select the group of contacts with whom he interacts more frequently, in order to successfully unlock the device. An additional (alternative) authentication mechanism was added to the lock scree, in case the user is not able to authenticate using the first one. This secondary mechanism is triggered automatically after several failed attempts to login or incorrect answers, and it consists on the insertion of a pre-configured PIN,