# H2O: Secure Interactions in IoT via Behavioral Fingerprinting
## 2 Related Works
### Human-to-Object Approaches  
Although continuous authentication is a relatively new type of verification, it is gaining attention of researchers and companies seeking new forms to protect sensitive data for unauthorized access [2]. Basically, continuous authentication performs an ongoing monitoring of user interactions with objects and builds a behavior or biometrics profile leveraging Machine Learning (ML) technology to re-verify the legitimacy of the connected nodes and assure cybersecurity protection.  
The application of this new form of authentication is advantageous also when traditional forms of verification do not fit the appropriate level of security. Indeed, _(i)_ single-factor authentication, which provides protection at login, and _(ii)_ two-factor authentication, which adds a second device for security check at the login phase, do not offer continuous validation of a user's identification.  
With the aim to balance security and usability, biometric approaches are gaining momentum. Given the nature of IoT devices and their closeness to users, using them for continuous authentication purposes is specially attractive [24]. For example, smart mobile devices like smartphones and tablets are equipped with various built-in sensors like camera for iris recognition, heart-bit sensor, fingerprint scanner and microphone for voice recognition among others. But if on one hand, they are more secure, since biometric traits like iris or face are difficult to be reproduced, on another this type of authentication may provide also false positives and true negatives [25].  
The authors of [26] identify two categories of biometric identification: physiological identification and behavioral one. The former includes facial, voice and fingerprint recognition, which are mostly device dependent mechanisms and require costly processing units. The latter is a form of continuous identification which is based on behavioral traits and is less intrusive, because it relies on human habitual patterns like typing [27; 28], walking [29], social interactions and communication.  
In [8] the authors describe WifiU, a Wi-Fi based human authentication system which recognizes users extracting unique biometrics information from Wi-Fi signals and uses it to perform human authentication. In particular, it is based on user gait. Indeed, the authors start from the consideration that, Wi-Fi signal reflected by the human body generates unique, although small, variations in wireless channel metrics on the receiver, due to the well-known multipath effect of wireless signals.  
A recent trend analysed by a number of researchers deals with continuous identification of users on mobile devices within the social IoT paradigm [13; 14]. In particular, in [14] the authors propose a scheme based on online behaviometrics of mobile users collected via smartphones. This scheme is able to extract features from smartphone sensors and users' social network interactions. In [13], instead, the authors propose a mobile behaviour framework that assesses users' social activity, and introduce sociability metrics to generate signatures of users' activities.  
The papers cited above aim at continuously authenticating the user by exploiting his interactions with IoT devices or against third parties. With respect to these approaches, our proposals has a more extended objective. Indeed, with the aim of enabling reliable human-to-human interactions, our framework leverages some of the strategies described in this section to obtain continuous authentication of humans with their objects. Moreover, we develop an advanced mechanism to constantly verify whether the identity of an object or a human is unchanged.