Continuous and Transparent User Identity Verification for Secure Internet Services

Research Area: Uncategorized Year: 2015
Type of Publication: Article
Authors: Andrea Ceccarelli; Leonardo Montecchi; Francesco Brancati; Paolo Lollini; Angelo Marguglio; Andrea Bondavalli
Journal: IEEE Transactions on Dependable and Secure Computing Volume: 12
Number: 3 Pages: 270-283
Month: May-June
© IEEE, 2015. This is the author's version of the work. It is posted here by permission of IEEE for your personal use. Not for redristibution. The final publication is available at ieeexplore.ieee.org
Session management in distributed Internet services is traditionally based on username and password, explicit logouts and mechanisms of user session expiration using classic timeouts. Emerging biometric solutions allow substituting username and password with biometric data during session establishment, but in such an approach still a single verification is deemed sufficient, and the identity of a user is considered immutable during the entire session. Additionally, the length of the session timeout may impact on the usability of the service and consequent client satisfaction. This paper explores promising alternatives offered by applying biometrics in the management of sessions. A secure protocol is defined for perpetual authentication through continuous user verification. The protocol determines adaptive timeouts based on the quality, frequency and type of biometric data transparently acquired from the user. The functional behavior of the protocol is illustrated through Matlab simulations, while model-based quantitative analysis is carried out to assess the ability of the protocol to contrast security attacks exercised by different kinds of attackers. Finally, the current prototype for PCs and Android smartphones is discussed.

Resilient Computing Lab, 2011

Joomla - Realizzazione siti web