The article discusses the possibilities of using biometric authentication methods to improve the cybersecurity of the infrastructure of mobile devices and wearable electronics. It has been established, that approaches for collecting and analyzing parameters are also suitable for the formation of authentication systems for the Internet of things. Analysis and selection of characteristics required for identification are carried out. Biometric methods are based on identifying a person according to his inherent characteristics. The main advantage of biometric methods is that such signs cannot be stolen or transferred to another person. Biometric authentication does not identify a user with absolute precision. There is always a possibility of errors of the first (access denial) and second kind (false access).To solve the problem of providing an additional intermediate layer of data protection and encryption on a physical device, a mobile client-server application has been developed based on the technology of using dynamic biometric authentication methods.
The widespread use of mobile devices and wearable electronics, as well as the high
pace of changing trends in mobile applications, make the issue of security of stored
data's security highly important. The decentralized nature of the information
distribution environment poses more and more challenges for security professionals. And new
approaches are not long in coming, for example, the decentralized nature of the IoT
environment requires support for multi-entitlement attribute-based encryption (ABE)
to implement granular access control [
Messenger developers tend to go for tricks when implementing applications' security. They often claim their applications to contain certain security mechanisms, which are aimed to make users feel protected. However, practical researches of such implementations do not always confirm the declared safety.
In one of our articles [
The purpose of the article is to study the implementation of an additional encryption layer and the possibilities for implementing additional data protection on mobile devices. 2
Some sources describe the advantages of network coding with its inherent algebraic
structure and the maximum stream performance achieved with the multicast
transmission. With network coding, content can be requested through multiple interfaces,
greatly improving the efficiency of information delivery [
In our opinion and according to studies of other authors, the use of dynamic methods of biometric authentication is one of the most promising methods of protecting data on mobile devices. These and other methods of preventing and eliminating cyber threats are combined into the concept of cybersecurity.
When a malefactor gets access to a device, there is a threat of leakage of important information during the entire period of interaction.
Modern biometric authentication is based on two methods [
Biometric authentication cannot guarantee absolute accuracy when identifying a
user. Despite that, users' biometric characteristics will continue playing the main role
in authentication, until a strong theoretical basis and a sufficient amount of practical
usage experience is obtained for other authentication mechanisms, for instance, the
algorithms based on post-quantum cryptosystems [
There are two main mathematical approaches to solving the problem of recognizing the keyboard handwriting of a device user: probabilistic-statistical; based on neural network algorithms.
Classic statistical approaches to user identification by keystroke handwriting are not able to provide reliable continuous user recognition. Also, statistical methods for recognizing keyboard handwriting are based on the fact that the input values are subject to the normal distribution law, although the incoming data stream does not always correspond to such a distribution.
According to the studies [
The approach based on neural networks helps solve some problems that arise when
using standard statistical methods for processing the input data stream. Analysis of such
deep learning models as recurrent neural networks, deep neural networks, bounded
Boltzmann machines, deep belief networks, convolutional neural networks, deep
Boltzmann machines, and deep autoencoders raises the question of studying performance in
two categories of classification: binary and multiclass [
In our opinion, the third approach, based on the construction of nonlinear dynamic models, is optimal. This approach is largely based on the ideas and methods of nonlinear dynamics. The construction of nonlinear dynamic models will not be problematic, provided that there is a sufficient amount of guaranteed true information about the real system, which makes it possible to define the fundamental relations and obtain the necessary equations.
The probability of correct user recognition with established keyboard skills is 98%,
which satisfies the successful practical applicability of such systems completely [
The results of the study make it possible to highlight the following advantages of using biometric authentication methods in mobile devices in general and in mobile applications in particular: no additional equipment required; no additional user skills or actions required; the possibility of hidden authentication is provided. A user may not even be aware of the fact that additional verification is enabled, thus he will not be able to inform the attacker about it.
User recognition efficiency based on dynamic methods of biometric user authentication reaches 92.14%. 3
An application prototype for the Android operating system has been created. The main stages of the application are shown in the figure (see Fig. 2).
The stage of collecting characteristics/training includes obtaining the values of the parameters described above. The creating of a keyboard template includes the analysis of the obtained parameter values and the formation of a reference template, with which the values obtained when trying to log into the system will be compared in the future.
Updating the database of keyboard profiles consists of updating the templates stored in the database. User identification is confirmation of a user's identity and then obtaining permission or denying access. The developed application is intended for the continuous collection of information about keystrokes in Russian / English and the identification of an authorized or unauthorized user. The system implements a client-server architecture. There is a Java application that can read biometric data on the client side. The test sample contains the entered password and dynamic characteristics, as well as the name of the authentication profile (see Fig. 3).
The software product implements 3 operating modes of the application and keyboard handwriting recognition:
The essence of continuous monitoring is that it can be used during authentication
and after it has passed:
monitoring all keyboard user activity. Quite resource-intensive for the solver, since
the reference database requires storing the time-stamps of all characters that the user
once entered;
approach, based on frequent bigrams. Less resource-intensive, as only pairs of the
most common letters, are used [
The application builds a reference template based on one parameter - the key hold time and a given passphrase known to both the legitimate user and the attacker. Table 2 shows the results obtained. not a single value of the parameter of the reference template of keyboard handwriting coincided among users, therefore, it can be concluded that each person has his unique keyboard handwriting; for the first test of the system, the smallest difference is observed for holding the "n" key (0.6ms), the largest for the "f" key (19.5ms); for the second test of the system, the smallest difference is observed for holding the "e" key (1.5ms), the largest for the "r" key (16ms); for the third test of the system, the smallest difference is observed for holding the "e" key (1.5ms), the largest difference for holding the "c" key (34ms).
Based on the test results, it can be concluded that a large percentage of errors of the first and second kind occur due to an insufficient amount of data received on the server to form a standard keyboard handwriting. It is also concluded that using a single parameter (key holding time) is not enough to form a standard keyboard handwriting. It should be noted that testing was carried out continuously for three experiments, i.e. users were entering a well-known phrase monotonously during a certain period. Since it is uncomfortable for a user, further testing should be carried out intermittently for a long period (at least for a day) to track the trend of changing the keyboard handwriting of different people over the same period. Moreover, the monotonous input of a nonchanging phrase causes results distortion, which leads to the conclusion that it is more beneficial to use the input of free text for testing purposes.
As a result, an additional intermediate stage of protecting mobile application data is proposed. It is expected to provide efficient defense from potential intruders' attacks. The new security level has the following features: independence from other protection methods; the possibility of independent usage as the only means of organizing information security; the possibility of a complex application in conjunction with other tools with the help of advanced integration and interaction tools; the prospects of using the direction of dynamic biometric methods in conjunction with the technological development of mobile devices and wearable electronics; presence of infrastructure for further research.