# EchoIA: A Cloud-Based Implicit Authentication Leveraging User Feedback
## 3 The System Overview
### The Authentication Phase  
To dynamically adjust personal features, the system can directly send the message to users to request new features, but this approach will break IA's transparency. In addition, it is difficult for the system to decide the \"right time\" to send the request, since the system will not know the behavioral change unless it analyzed the data. In EchoIA, instead of analyzing users' behavioral data, the system leverages the correct rate of inputted passwords to dynamically adjust personal features.  
At the _Authentication_ phase, as shown in Figure 1b, the system will reduce the weights of each feature in \(F_{top}\) if users input correct passwords. Since users only need to input passwords when IA locks the device, correct passwords indicate current users have a large chance of being legitimate. Similarly, the system will increase the weight of each feature in \(F_{top}\) if users input incorrect passwords. The new weight is updated by \(\delta_{n}\).  
\[\delta_{n}=\delta_{n}^{(C)}-\delta_{n}^{(I)}, \tag{4}\]  
where \(\delta_{n}^{(I)}\) is the amount of weight increased for the feature \(n\) in \(F_{top}\); \(\delta_{n}^{(C)}\) is the amount of weight decreased for the feature \(n\) in \(F_{top}\). The new weight of the feature \(n\) is calculated by \(w_{n}+\delta_{n}\) (\(\delta_{n}^{(C)}\) indicates the system has less confidence in the current data samples).  
In EchoIA, a predefined threshold \(\Delta\) is used to measure the significance of the weight change. In practice, we choose \(\Delta\) by using k-fold cross-validation. If the change is significant, \(\delta_{n}>\Delta\), the system will challenge the users to input a PIN number, which is the number different from passwords used to unlock the device. The users can choose the PIN number at the _Initialization_ phase. If the users type a correct PIN and agree with personal features' change, EchoIA will update \(F_{top}\) and personal features according to the new weights in \(F\). In this process, decayed features will be replaced by new features. The system will use the updated personal features to identify the users until \(\delta_{n}>\Delta\) again. We adopted the support vector machine (SVM) to achieve the user classification and to identify legitimate users. The parameters in the model are optimized by using k-fold cross-validation. We have summarized the _Authentication_ phase in Algorithm 1.  
```
Input: A Password Input, \(\delta_{n}\) in the Previous Step Output:\(\delta_{n}\) in the Current Step
1 initialize psw:=A Password Input ;
2 initialize \(D[n]_{pre}\):=\(\delta_{n}\) in the Previous Step ; /* \(D[n]_{pr}\) denotes the weight change amount of \(f_{n}\) in the previous step. */
3 initialize \(D[n]_{cur}\):= \(D[n]_{pr}\) ; /* \(D[n]_{cur}\) denotes the weight change amount of \(f_{n}\) in the current step. */ /* The system will not update \(F_{\text{up}}\) if \(D[n]_{cur}\leq\Delta\). */
4 if(psw=PSW_LEGITIMATE_USER)then /* The current user inputs the correct password. */
5 f[n]=f[n]-C; /* Reducing the weight of corresponding feature. */
6 temp_change=C; /* The amount of change in the current step (Usually a positive value). */
7
8 else /* The current user inputs the wrong password. */
9 f[n]=f[n]+I; /* Increasing the weight of corresponding feature. */
10 temp_change=-I; /* The amount of change in the current step (Usually a negative value). */
11\(D[n]_{cur}\)=\(D[n]_{cur}\)+temp_change; /* The total amount of weight changes until the current step. */
12 return\(D[n]_{cur}\) ; /* The system will update \(F_{\text{up}}\) if \(D[n]_{cur}>\Delta\). */
```  
**Algorithm 1**EchoIA (Simplified).