Continuous authentication (CAuthN) of users extends conventional authentication methods to ensure that only authorized individuals can access resources such as devices or applications while using authenticated sessions. Current research on CAuthN focuses mainly on the extraction of meaningful biometric features and the development of suitable evaluation algorithms. In comparison, systemic aspects that must be equally present for the effective use of CAuthN, such as deployment scenarios and attacker models, have only been insufficiently investigated and appear fragmented in the literature. We conduct a systematic review of the existing CAuthN literature to analyze the body of knowledge concerning scenarios in which CAuthN systems are deployed, the types of attacks they protect against, the integration of CAuthN components into existing IT systems, and their response to detected attacks. We uncover numerous shortcomings and inconsistencies, discuss them, and translate them into research questions that must be addressed before CAuthN systems can be established successfully in practice.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

SoK: Continuous Authentication Beyond Error Rates: Reviewing General System Properties

  • Florian Dehling,
  • Sebastian Kawelke,
  • Luigi Lo Iacono

摘要

Continuous authentication (CAuthN) of users extends conventional authentication methods to ensure that only authorized individuals can access resources such as devices or applications while using authenticated sessions. Current research on CAuthN focuses mainly on the extraction of meaningful biometric features and the development of suitable evaluation algorithms. In comparison, systemic aspects that must be equally present for the effective use of CAuthN, such as deployment scenarios and attacker models, have only been insufficiently investigated and appear fragmented in the literature. We conduct a systematic review of the existing CAuthN literature to analyze the body of knowledge concerning scenarios in which CAuthN systems are deployed, the types of attacks they protect against, the integration of CAuthN components into existing IT systems, and their response to detected attacks. We uncover numerous shortcomings and inconsistencies, discuss them, and translate them into research questions that must be addressed before CAuthN systems can be established successfully in practice.