مقاله انگلیسی رایگان در مورد احراز هویت ضمنی با حفظ حریم خصوصی کارآمد – الزویر ۲۰۱۸

Implicit authentication refers to a software system authenticating individuals based on the way they interact with their device, i.e. their behavior. In this context, the user behavior can be determined by collecting a variety of features, such as keystroke patterns, browser history and configuration, IP addresses, location, visible antennas, etc. Implicit authentication is a complement, rather than a substitute, of the usual explicit authentication based on identifiers and/or credentials. Authenticating implicitly can make life easier for users by reducing the number of times they have to authenticate explicitly. Implicit authentication is gaining importance as the smartphone market rises. Relatively small and sometimes unwieldy screen keyboards in smartphones make typing strong passwords a difficult task. This situation, added to the well-known problem of weak password choices, repeatedly aired in the media, makes the use of secondary authentication mechanisms almost mandatory. Among these, biometric (fingerprint) authentication and two-factor authentication with onetime passwords are the most common choices. Biometric authentication has the shortcomings of needing special sensors in the user’s device and requiring the authenticating server to acquire and store the user’s reference biometric pattern. Two-factor authentication, on its side, has an intrinsic problem: the second channel (email, SMS, mobile app) used for confirmation is usually accessible on the same device (typically an Internet-enabled smartphone) used for the primary channel, so both channels may be simultaneously compromised. Implicit authentication is not free of problems either. A salient issue is the privacy exposure of end users, who need to be profiled in order to provide a reference pattern against which their current behavior can be authenticated by the server. To keep the user’s profile private against the server, researchers have proposed privacy-preserving implicit authentication [6,18]. In these proposals, the user’s reference profile is stored in encrypted form at the server and the fresh usage sample captured by the user’s device is compared against that reference profile. While this solves the privacy issues, it entails substantial computation, both by the user’s device and the server.