Source-linked AI summary
Multi-sensor authentication to improve smartphone security
Wei-Han Lee, Ruby Lee
TL;DR
Smartphone theft can expose personal information and enable impersonation, while password-based access has security and usability weaknesses. This paper uses smartphone sensors to authenticate users continuously and implicitly, reporting accuracy above 90% and up to 95%.
Problem
Smartphone theft can expose personal information and enable impersonation, while passwords are vulnerable to attacks and many users avoid using them on phones.
Source: §1 · p. 1Method
The system uses accelerometer, orientation-sensor, and magnetometer measurements with an SVM owner profile for continuous, implicit authentication that adapts over time.
Source: §1 · p. 2, §3.3 · p. 6Results
Above 90%, reaching 95%, authentication accuracy is reported; the three-sensor approach performs best, with a smaller gain from two sensors than from one to two.
Source: §1 · p. 2Takeaways & Limitations
Changing the sampling rate lets users adjust the system’s security level.
Source: §1 · p. 2The conclusion identifies unresolved privacy issues and proposes richer sensor information and combining time and frequency information as future research directions.
Source: §5 · p. 10
Abstract
from arXiv · showhide
The widespread use of smartphones gives rise to new security and privacy concerns. Smartphone thefts account for the largest percentage of thefts in recent crime statistics. Using a victim's smartphone, the attacker can launch impersonation attacks, which threaten the security of the victim and other users in the network. Our threat model includes the attacker taking over the phone after the user has logged on with his password or pin. Our goal is to design a mechanism for smartphones to better authenticate the current user, continuously and implicitly, and raise alerts when necessary. In this paper, we propose a multi-sensors-based system to achieve continuous and implicit authentication for smartphone users. The system continuously learns the owner's behavior patterns and environment characteristics, and then authenticates the current user without interrupting user-smartphone interactions. Our method can adaptively update a user's model considering the temporal change of user's patterns. Experimental results show that our method is efficient, requiring less than 10 seconds to train the model and 20 seconds to detect the abnormal user, while achieving high accuracy (more than 90%). Also the combination of more sensors provide better accuracy. Furthermore, our method enables adjusting the security level by changing the sampling rate.
1 INTRODUCTION
Smartphone theft can expose personal information and enable impersonation, while password-based access has security and usability weaknesses. The paper proposes continuous, implicit authentication using smartphone sensors, with reported high accuracy and configurable sampling rates.
1 INTRODUCTION
- Smartphone theft can expose personal information and enable attackers to impersonate victims, while passwords are vulnerable to guessing and social engineering and can burden users.The cited study reports that 64% of users do not use passwords on their smartphones.Source: §1 · p. 1
- The system uses accelerometer, orientation-sensor, and magnetometer data to build and adapt an owner profile for continuous authentication without interrupting interactions.It alerts the security system when abnormal use is detected, so access can be restricted and further checks taken.Source: §1 · p. 2
- Less than 10 seconds are needed to train the model each day, and 20 seconds to detect abnormal use.The authors report these timings alongside accuracy of 90%, up to 95%.Source: §1 · p. 2
- Above 90%, reaching 95%, authentication accuracy accompanies the three-sensor method’s best performance among single-, two-, and three-sensor variants.The authors report results on two data sets; adding a third sensor gives a smaller improvement than moving from one sensor to two.Source: §1 · p. 2
- Changing the sampling rate lets users adjust security levels, and the paper analyzes the trade-off between authentication accuracy and training time.The authors describe the resulting sampling-rate and data-size trade-off as practical for commodity smartphone use.Source: §1 · p. 2
2 BACKGROUND
Smartphones expose many possible sensor and behavioral inputs, but this paper focuses on a small sensor set. Prior authentication approaches vary in their inputs, accuracy, detection time, and need for user scripting.
2.1 Smartphone inputs and sensors
- Smartphones provide motion, environmental, location, audio, and device-use measurements; the paper’s sensor tables describe measurements, common uses, and permission requirements.The authors note that a small sensor set should represent user characteristics, and focus on accelerometer, orientation sensor, and magnetometer.Source: §2.1 · p. 2, Table 2 · p. 3
2.2 Related work
- Background mobile-sensing services can continually collect sensor information, while prior work reports detection in 717 seconds without quantitatively reporting accuracy.SenSec reports 75% accuracy identifying users and 71.3% detecting non-owners, but requires users to follow a script.Source: §2.2 · p. 3
- Prior authentication also uses GPS mobility, biometrics, and sensor-derived signals; several approaches require scripted user actions, while sensor measurements can reveal PINs or sensitive context.The comparison table defines false-positive and false-negative rates, training and detection times, and whether a script is required.Source: §2.2 · pp. 3–4, Table 3 · p. 4
3 KEY IDEAS
The system uses smartphone sensor measurements and SVM classification for implicit authentication. The section explains its sensor choices, datasets and re-sampling, and classification approach.
3.2 Data Sets and Re-sampling
- The PU and GCU datasets provide sensor measurements from four users each; re-sampling averages contiguous measurements to reduce processing complexity and noise.PU data covers approximately five days per user; GCU data covers approximately three weeks, with both datasets restricted to the three selected sensors for comparison.Source: §3.2 · p. 5, §3.1 · p. 5
- The method collects selected-sensor data and uses SVM classification to distinguish usage patterns and authenticate smartphone users; it produces the legitimate user’s profile and retrains it daily in less than 10 seconds.Source: §3.2 · p. 5, §3.3 · p. 6
3.1 Sensor Selection
- Accelerometers, orientation sensors, and magnetometers represent coarse motion, fine-grained phone-holding motion, and potentially the user’s environment, without requiring Android permission.The paper uses these three sensors to compare measurements across its datasets.Source: §3.1 · p. 5
3.3 Support Vector Machines
- SVM classifies sensor-derived features by finding a maximum-margin hyperplane, with the owner’s data labeled positive and other users’ data labeled negative.Its objective minimizes reciprocal margin and misclassification loss; the experiments implement SVM using LIBSVM.Source: §3.3 · p. 6
4 EXPERIMENTAL RESULTS
The experiments compare single-, two-, and three-sensor authentication across datasets, sampling rates, and training-data sizes. They evaluate accuracy alongside the training-time cost of higher sampling rates and larger data sizes.
4.1 Single-sensor authentication
- Single-sensor accuracy remains below 90% even at fast sampling rates such as 10 seconds; accelerometer and magnetometer outperform the more variable orientation sensor.Faster sampling improves accuracy, and longer-term movement and environment characteristics may be more useful than how a user holds the phone.Source: §4.1 · pp. 6, 8, Figure 3 · p. 7
4.2 Two-sensor authentication
- At a 20-second sampling interval, two sensors improve accuracy over one by an average of 7.4% on PU and 14.6% on GCU.The magnetometer-orientation pair can perform worse than pairs that include the accelerometer, and is not necessarily better than the accelerometer alone.Source: §4.2 · p. 8
4.3 Three-sensor authentication
- Three-sensor authentication achieves the best accuracy among the single-, two-, and three-sensor systems on both datasets.Accuracy increases with faster sampling; at a 20-second interval, the average gain over two sensors is 3.3% on PU and 4.4% on GCU.Source: Figure 5 · p. 7, §4.3 · p. 8, §4.4 · p. 8
4.4 Training Time vs. Sampling Rate
- At a 20-second sampling interval, three-sensor accuracy exceeds 90% on PU and 95% on GCU, with profile training under 10 seconds and roughly 1 second, respectively.The paper presents this as a practical balance between authentication performance and training time.Source: §4.4 · p. 8, Table 4 · p. 8, Table 5 · p. 10
- Smaller sampling intervals require more training time, creating a trade-off between authentication performance and computational complexity.The reported training time rises exponentially as the sampling rate increases.Source: §4.4 · p. 8, Figure 6 · p. 9, Table 5 · p. 10
4.5 Accuracy and Time vs. Data size
- With a 10-minute sampling interval, increasing training data size improves accuracy but usually also increases training time.The experiments vary data size from 1 to 5 days on PU and 1 to 15 days on GCU.Source: §4.5 · p. 10, Figure 7 · p. 10
5 CONCLUSION
The conclusion describes a three-sensor SVM system for distinguishing a smartphone’s owner from other users. It reports that sensor combinations improve accuracy and identifies further sensor information, time and frequency information, and privacy as areas for consideration.
5 CONCLUSION
- The system uses accelerometer, orientation, and magnetometer data with SVM to distinguish the owner from other users.The orientation sensor contributes less than the other two sensors, which tend to capture more stable, longer-term movement and physical-location characteristics.Source: §5 · p. 10
- The conclusion reports that multi-sensor authentication improves accuracy, while orientation-sensor data is less important than accelerometer and magnetometer data.Source: §5 · p. 10
- The authors identify more detailed sensor information and combining time with frequency information as research directions, while noting that privacy issues remain.Source: §5 · p. 10