# Design and Implementation of a Contextual-Based Continuous Authentication Framework for Smart Homes
## 2 Related Work  
Traditional authentication techniques, such as usernames and passwords, are insufficient for a mobile environment where users require access from different locations. This requires the adoption of alternative authentication approaches, or enhancements to traditional authentication methods. To this end, many alternative authentication approaches, that can be adapted for smart homes, have been proposed. Single sign-on (SSO) is a user authentication technique that uses a single login credential to access multiple applications [18; 19; 20]. This method does not require users to provide login credentials for many applications. However, it could increase the risk of hacking all other applications that can be accessed under the same authentication if, for example, the login credentials are attained by an attacker. Moreover, SSO is still point-of-entry, and it is impractical to require users to continuously provide SSO credentials for authentication. Additionally, authentication mechanisms such as SSO assume that the legitimate user is the one who accesses the service throughout the entire access session [20]. Token-based authentication approaches have been developed for overcoming the drawbacks of secret knowledge-based approaches such as passwords. Token-based authentication methods can be classified into two categories: hardware tokens and software tokens. Hardware token mechanisms need the user to carry tokens. However, physical tokens, which are only considered as point-of-entry, are susceptible to theft or loss, and are also difficult to utilize for continuous authentication throughout an entire access session. Software tokens use the end-user's device by, for example, sending the password as a message to the user's registered device, such as mobile phone, to be used for logging in to the service. A software token, such as Google Authenticator, in the form of software installed on the end-user's device, issues a new password (time-based one time password) that changes with every access time [20; 21]. Token-based authentication can provide some advantages over knowledge-based authentication techniques as they remove the burden from users having to remember and choose robust passwords. However, it is inconvenient for users to have to continuously provide generated passwords for continuous authentication throughout the entire access session. In order to overcome the drawbacks of using static authentication credentials, another technique that involves biometric features, such as fingerprints, which are being developed and used especially for specific locations where users are expected to access the required services [22; 23; 24]. Although these attributes are considered to be strong against attacks, they are impractical for mobile users who need access to services from different places. Biometric features, such as fingerprint or facial recognition, can be considered as robust for authentication, and would have a very small response time limitation in the smart home environment. However, not all smart devices are provided with physiological biometrics such as fingerprint or iris recognition capabilities. In addition, it would be inconvenient to require users to re-enter their biometrics every time for continuous authentication. Moreover, one of the issues with biometric authentication features is that they are not privacy-preserving [25], which limits the adoption of biometrics for many applications. For example, one of the issues regarding biometrics is that it is impossible to revoke registered biometrics information, in cases where is compromised by an attacker [26]. In addition, the system of biometrics is not widely accepted by users because it is perceived as intrusive and a violation of personal privacy [27]. While technologies such as iris scanners are readily available on smartphones, the recent case of the Samsung Galaxy S8 iris scanner demonstrated how easy this technology can be deceived by using an infrared image and a contact lens [28].