ZEMFA: ZeroEffort MultiFactor Authentication based on MultiModal Gait Biometrics In this paper, we consider the problem of transparently authenticating a user to a local terminal (e.g., a desktop computer) as she approaches towards the terminal. Given its appealing usability, such zeroeffort authentication has already been deployed in the realworld where a computer terminal or a vehicle can be unlocked by the mere proximity of an authentication token (e.g., a smartphone). However, existing systems based on a single authentication factor contains one major security weakness  unauthorized physical access to the token, e.g., during lunchtime or upon theft, allows the attacker to have unfettered access to the terminal. We introduce ZEMFA, a zeroeffort multifactor authentication system based on multiple authentication tokens and multimodal behavioral biometrics. Specifically, ZEMFA utilizes two types of authentication tokens, a smartphone and a smartwatch (or a bracelet) and two types of gait patterns captured by these tokens, midlower body movements measured by the phone and wristarm movements captured by the watch. Since a useru0027s walking or gait pattern is believed to be unique, only that user (no impostor) would be able to gain access to the terminal even when the impostor is given access to both of the authentication tokens. We present the design and implementation of ZEMFA. We demonstrate that ZEMFA offers a high degree of detection accuracy, based on multisensor and multidevice fusion. We also show that ZEMFA can resist active attacks that attempt to mimic a useru0027s walking pattern, especially when multiple devices are used.

Authenticating Phone Users Using a GaitBased Histogram Approach on Mobile App Sessions Collectively, userfriendly interfaces, small but impactful sensing technologies, intuitive device designs, and the variety of mobile applications (or apps) have transformed the expectations for cellular phones. Apps are a primary factor in device functionality; they allow users to quickly carry out tasks directly on their device. This paper leverages mobile apps for continuous authentication of mobile device users. We borrow from a gaitbased approach by continuously extracting nbin histograms from numerically encoded app data. Since more active subjects will generate more data, it would be trivial to distinguish between these subjects and others which are not as active. Thus, we divided a dataset of 19 months of app data from 181 subjects into three datasets to determine if minimally active, moderately active, or very active subjects were more challenging to authenticate. Using the absolute distance between two histograms, our approach yielded a worstcase EER of 0.188 and a bestcase EER of 0.036 with a worstcase initial training period of 1.06 hours. We also show a positive correlation between user activity level and performance, and template size and performance. Our method is characterized by minimal training samples and a contextindependent evaluation, addressing important factors which are known to affect the practicality of continuous authentication systems.