User Authentication on Mobile Devices: Approaches, Threats and Trends Abstract   Mobile devices have brought a great convenience to us these years, which allow the users to enjoy the anytime and anywhere various applications such as the online shopping, Internet banking, navigation and mobile media. While the users enjoy the convenience and flexibility of the xe2x80x9dGo Mobilexe2x80x9d trend, their sensitive private information (e.g., name and credit card number) on the mobile devices could be disclosed. An adversary could access the sensitive private information stored on the mobile device by unlocking the mobile devices. Moreover, the userxe2x80x99s mobile services and applications are all exposed to security threats. For example, the adversary could utilize the userxe2x80x99s mobile device to conduct nonpermitted actions (e.g., making online transactions and installing malwares). The authentication on mobile devices plays a significant role to protect the userxe2x80x99s sensitive information on mobile devices and prevent any nonpermitted access to the mobile devices. This paper surveys the existing authentication methods on mobile devices. In particular, based on the basic authentication metrics (i.e., knowledge, ownership and biometrics) used in existing mobile authentication methods, we categorize them into four categories, including the knowledgebased authentication (e.g., passwords and lock patterns), physiological biometricbased authentication (e.g., fingerprint and iris), behavioral biometricsbased authentication (e.g., gait and hand gesture), and twomultifactor authentication. We compare the usability and security level of the existing authentication approaches among these categories. Moreover, we review the existing attacks to these authentication approaches to reveal their vulnerabilities. The paper points out that the trend of the authentication on mobile devices would be the multifactor authentication, which determines the userxe2x80x99s identity using the integration (not the simple combination) of more than one authentication metrics. For example, the userxe2x80x99s behavior biometrics (e.g., keystroke dynamics) could be extracted simultaneously when heshe inputs the knowledgebased secrets (e.g., PIN), which can provide the enhanced authentication as well as sparing the userxe2x80x99s trouble to conduct multiple inputs for different authentication metrics.

Gesturebased User Identity Verification as an Open Set Problem for Smartphones The most straightforward, yet insecure, methods of authenticating a person on smartphones derive from the solutions applied to personal computers or smart cards, namely the authorization by passwords or numeric codes. Alarmingly, the widespread use of smartphone platforms implies that people are carrying around sensitive information in their pocket, making the information more available physically. As smartphone owners are often using their devices in public areas, these short numeric codes or other forms of passwords can be obtained quickly through shoulder surfing, resulting in making that restricted data far more accessible for those who are not authorized to access the device. In this paper, we address the problem of biometric verification on smartphones. We propose a new approach for gesturebased verification that makes use of open set recognition algorithms. Further, we introduce a new database of inertial measurements to investigate the user identification capabilities of this approach. The results we have obtained indicate that this approach is a feasible solution, although the precision of the method depends highly on the chosen samples of the training set.