Toward secure and robust user authentication on mobile devices
Creators: name: Hu, Bin
Publisher: name: No Publisher Supplied
Year: 2023

description: User authentication, which verifies the identity of a user attempting to gain access to credentials resources, has become increasingly vital and is broadly deployed at almost every corner (e.g., facilities, airports, apartment buildings, and smart homes) on mobile devices. Although the mobile sensing community continues to evolve with the advancements of user verification approaches, some bottlenecks still exist in securely deploying user verification systems in real-world resource-constraint mobile application scenarios. 1) Traditional one-time verification methods request a user to provide his/her credentials (e.g., password or fingerprint) during each verification process. Such practices are inconvenient and flawed from security perspectives. Moreover, existing behavioral-based continuous verifications leverage specific human physical behaviors (e.g., gait pattern, keystroke, and hand gestures) to identify the user and existing physiological-based approaches leverage always-exist vital signs (e.g., cardiac biometrics, speech characteristics, and respiratory patterns) to perform non-intrusive user verification continuously. However, all these existing approaches require dedicated devices or users' active participation, which are not applicable in many practical scenarios. 2) Inferring user identities from mobile sensor data under real-world conditions remains brittle and unreliable (e.g., environmental dynamics, body movements and emotions, and diverse users), preventing user authentication applications from being ready for use – especially those that require more difficult (but also powerful) forms of user profile modeling. Benefiting from the recent advancement of Deep Neural Networks (DNNs), DNN-based approaches have achieved state-of-the-art performance in solving a variety of application problems, such as object recognition, face recognition, video classification, and AR/VR. Thus, more mobile applications (i.e., user authentication) should benefit from using DNNs to achieve robust and promising outcomes. In addition, user verification applications could benefit from utilizing the powerful DNN to improve the system performance crossing different domains. However, state-of-art mobile devices still have limited memory size and computational capacity, which prevent them from running conventional DNNs. Therefore, it is highly desirable to design and develop efficient DNNs that can be deployed on mobile devices without performance degradation. 3) Recent studies show that DNNs and their memorized information on mobile devices are subject to a variety of security threats (e.g., Membership Inference Attack (MIA), Data Reconstruction Attack (DRA) and Property Inference Attack (PIA)). Thus, protecting DNNs and preserving their data privacy are critical for developing mobile applications on resource-limited mobile devices. In recent years, mobile devices have been increasingly equipped with small hardware-isolated Trusted Execution Environments (TEEs) responsible for security-critical operations. However, it is very challenging to execute DNNs using TEEs on mobile devices (mobile TEEs) due to the huge gap between the high demand for resources (i.e., memory and computing power) of DNNs and the stringent resource constraints of mobile TEEs. To support the evolving concept of user authentication on resource-constraint mobile devices securely, this dissertation mainly studies the following topics: 1) How to conduct robust passive RFID-based continuous user verification using respiration. 2) Design and develop efficient DNNs (which could be adopted by user authentication) that can be deployed on resource-constraint mobile devices without performance degradation. 3) Secure and optimize DNN execution with high accuracy and low latency using mobile TEEs. The designed solutions can be used along with existing authentication schemes (e.g., voice authentication, face recognition) to provide enhanced security and DNN-based mobile applications (e.g., mobile healthcare, mobile entertainment) on mobile TEE with higher security. We first design, BioTag, a passive continuous user verification system that utilizes low-cost radio frequency identification (RFID) technology to capture unique physiological characteristics rooted in the users' respiration motions for continuous user verification. We demonstrate that unique respiratory patterns can be extracted from RFID tags attached to users' clothes to capture without requiring active user participation. Specifically, we use two RFID tags attached to a user's chest and abdomen to capture the user's intrinsic respiratory patterns via RFID signals. We develop respiratory feature extraction methods based on waveform morphology analysis and fuzzy wavelet transformation (FWPT) to derive unique biometric information from the user's respiration signals. Furthermore, we develop an adaptive classifier using the gradient boosting decision tree (GBDT) to identify legitimate users and attackers accurately. Extensive experiments involving 41 participants demonstrate that BioTag can robustly authenticate users and detect various types of adversaries with low training effort. In particular, our system can achieve over 95.2% and 94.8% verification accuracy on random attack and imitation attack scenarios, respectively. Moreover, we develop a novel mixture pruning mechanism, MIXP, which can effectively reduce the computational cost of DNNs while maintaining a high weight compression ratio and model accuracy. We propose to remove neuron bond that can effectively reduce convolution computations and weight size in DNNs. We also design an influence factor to analyze the importance of neuron bonds and weights in a fine-grained way so that MIXP could achieve precise pruning with few retraining iterations. Experiments with MNIST, CIFAR-10, and ImageNet datasets demonstrate that MIXP could achieve significantly fewer FLOPs and retraining iterations on four widely-used DNNs than existing pruning methods. Finally, we develop a novel mobile TEE-based security framework that can efficiently execute the entire DNN in a resource-constrained mobile TEE with minimal inference time overhead. Specifically, we propose a progressive pruning to gradually identify and remove the redundant neurons from a DNN while maintaining a high inference accuracy. Next, we develop a memory optimization method to deallocate the memory storage of the pruned neurons utilizing the low-level programming technique. In addition, we devise a novel adaptive partitioning method that divides the pruned model into multiple partitions according to the available memory in the mobile TEE and loads the partitions into the mobile TEE separately with a minimal loading time overhead. Our experiments with various DNNs and open-source datasets demonstrate that we can achieve 2-30 times less inference time with comparable accuracy compared to existing approaches securing entire DNNs with mobile TEE.