A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones

Maria Papaioannou*, Filippos Pelekoudas-Oikonomou, Georgios Mantas, Emmanouil Serrelis, Jonathan Rodriguez, Maria-Anna Fengou, Amitabh Mishra (Editor)

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

8 Downloads (Pure)

Abstract

Mobile user authentication acts as the first line of defense, establishing confidence in the claimed identity of a mobile user, which it typically does as a precondition to allowing access to resources in a mobile device. NIST states that password schemes and/or biometrics comprise the most conventional user authentication mechanisms for mobile devices. Nevertheless, recent studies point out that nowadays password-based user authentication is imposing several limitations in terms of security and usability; thus, it is no longer considered secure and convenient for the mobile users. These limitations stress the need for the development and implementation of more secure and usable user authentication methods. Alternatively, biometric-based user authentication has gained attention as a promising solution for enhancing mobile security without sacrificing usability. This category encompasses methods that utilize human physical traits (physiological biometrics) or unconscious behaviors (behavioral biometrics). In particular, risk-based continuous user authentication, relying on behavioral biometrics, appears to have the potential to increase the reliability of authentication without sacrificing usability. In this context, we firstly present fundamentals on risk-based continuous user authentication, relying on behavioral biometrics on mobile devices. Additionally, we present an extensive overview of existing quantitative risk estimation approaches (QREA) found in the literature. We do so not only for risk-based user authentication on mobile devices, but also for other security applications such as user authentication in web/cloud services, intrusion detection systems, etc., that could be possibly adopted in risk-based continuous user authentication solutions for smartphones. The target of this study is to provide a foundation for organizing research efforts toward the design and development of proper quantitative risk estimation approaches for the development of risk-based continuous user authentication solutions for smartphones. The reviewed quantitative risk estimation approaches have been divided into the following five main categories: (i) probabilistic approaches, (ii) machine learning-based approaches, (iii) fuzzy logic models, (iv) non-graph-based models, and (v) Monte Carlo simulation models. Our main findings are summarized in the table in the end of the manuscript.
Original languageEnglish
Article number2979
JournalSensors
Volume23
Issue number6
Early online date9 Mar 2023
DOIs
Publication statusPublished - Mar 2023

Keywords

  • Article
  • continuous user authentication
  • risk-based user authentication
  • quantitative risk estimation
  • mobile devices
  • security vs. usability

Fingerprint

Dive into the research topics of 'A Survey on Quantitative Risk Estimation Approaches for Secure and Usable User Authentication on Smartphones'. Together they form a unique fingerprint.

Cite this