Pairing continuous authentication with proactive platform hardening

Abstract

Mobile authentication has always been a usability and security challenge. In the past, researchers have discovered various methods to bypass the screen lock protection mechanism without entering authentication credentials on mobile devices. There is a clear need for authentication to be seamless and continuous but also address the security threats that stem from the current unlock-once, always-on mechanisms. To that end, we developed a framework for continuous behavioral authentication of users. In addition, we introduce a configurable “authentication level” for access to resources and applications. For example, if a user's authentication level declines below a pre-specified threshold, all external communications are disabled to prevent exfiltration of sensitive data. Similarly, viewing or modifying any sensitive data on the device is also restricted by moderating access to the underlying file system based on the user's authentication level. We will perform a live demonstration of our entire system implemented for Android 6.0.1, and show how it can successfully defend against a wide range of attacks while improving the usability of the mobile device by offering a seamless authentication experience.