Best Paper Award

Martin Georgiev

Martin Georgiev

University of Oxford,
United Kingdom

Simon Eberz

Simon Eberz

University of Oxford,
United Kingdom

Ivan Martinovic

Ivan Martinovic

University of Oxford,
United Kingdom

Techniques for Continuous Touch-Based Authentication

The field of touch-based authentication has been rapidly developing over the last decade, creating a fragmented and difficult-to-navigate area for researchers and application developers alike due to the variety of methods investigated. In this study, we perform a systematic literature analysis of 30 studies on the techniques used for feature extraction, classification, and aggregation in touch-based authentication systems as well as the performance metrics reported by each study. Based on our findings, we design a set of experiments to compare the performance of the most frequently used techniques in the field under clearly defined conditions. In addition, we introduce three new techniques for touch-based authentication: an expanded feature set (consisting of 149 unique features), a multi-algorithm ensemble-based classifier, and a Recurrent Neural Network based stacking aggregation method. The comparison includes 14 feature sets, 11 classifiers, and 5 aggregation methods. In total, 219 model configurations are examined and we show that our novel techniques outperform the current state-of-the-art in each category. The results are also validated across three different publicly available datasets. Finally, we discuss the findings of our investigation with the aim of making the field more understandable and accessible for researchers and practitioners.


Sławomir Matelski

Sławomir Matelski

Łódź University of Technology,
Poland

Secure Human Identification Protocol with Human-Computable Passwords

In this paper we present a new method of secure humancomputer identification, which remains safe also in untrusted systems and environments. This method allows the elimination of any supplementary gadgets/devices or theft-sensitive biometric data used by the MultiFactor Authentication (MFA), and using only one secret as a universal private key for all obtainable online accounts. However, the features of this solution make it best suited for use by the Authentication Authority with the Single-Sign-On (SSO) method of identity and access management, rather than for individual services. Such a key is used by our innovative challenge-response protocol to generate One-Time-Password, e.g., 6-digit OTP, could be calculated by a human in only 12 s, also offline on paper documents with an acceptable level of security required for post-quantum symmetric cyphers, thanks to the hard lattice problem with noise introduced by our new method, which we call Learning with Options (LWO). The secret has the form of an outline like a kind of handwritten autograph, designed in invisible ink on the mapping grid. The password generation process requires following such an invisible contour on the challenge matrix created randomly by the verifier and reading values from secret fields to easily calculate each digit of OTP.