Award Abstract # 1750987
CAREER: Science of Security for Mobile User Authentication

NSF Org: CNS
Division Of Computer and Network Systems
Recipient: RUTGERS, THE STATE UNIVERSITY
Initial Amendment Date: April 10, 2018
Latest Amendment Date: January 25, 2021
Award Number: 1750987
Award Instrument: Continuing Grant
Program Manager: Sara Kiesler
skiesler@nsf.gov
 (703)292-8643
CNS
 Division Of Computer and Network Systems
CSE
 Direct For Computer & Info Scie & Enginr
Start Date: September 1, 2018
End Date: September 30, 2020 (Estimated)
Total Intended Award Amount: $507,568.00
Total Awarded Amount to Date: $189,178.00
Funds Obligated to Date: FY 2018 = $85,910.00
FY 2019 = $102,787.00

FY 2020 = $480.00
History of Investigator:
  • Janne Lindqvist (Principal Investigator)
    janne.lindqvist@rutgers.edu
Recipient Sponsored Research Office: Rutgers University New Brunswick
3 RUTGERS PLZ
NEW BRUNSWICK
NJ  US  08901-8559
(848)932-0150
Sponsor Congressional District: 12
Primary Place of Performance: Rutgers University New Brunswick
Piscataway
NJ  US  08854-3925
Primary Place of Performance
Congressional District:
06
Unique Entity Identifier (UEI): M1LVPE5GLSD9
Parent UEI:
NSF Program(s): Secure &Trustworthy Cyberspace
Primary Program Source: 01001819DB NSF RESEARCH & RELATED ACTIVIT
01001920DB NSF RESEARCH & RELATED ACTIVIT

01002021DB NSF RESEARCH & RELATED ACTIVIT
Program Reference Code(s): 025Z, 065Z, 1045, 7434
Program Element Code(s): 806000
Award Agency Code: 4900
Fund Agency Code: 4900
Assistance Listing Number(s): 47.070

ABSTRACT

Mobile devices contain a collection of personal, private, and financial information that, if accessed by an unauthorized user, has the potential to be severely compromising. Thus, it is important for mobile devices to verify whether their users are allowed to access the device and its services. We call this mobile authentication, and it is frequent, prevalent, and necessary. The need to protect data from unauthorized access is important to understand, irrespective of whether an end-user ultimately opts out of using authentication. It is incumbent on manufacturers and researchers to provide usable and secure methods that everyone can use. To reach that point requires solid scientific understanding. This project will scientifically evaluate the metrics and measurement techniques for accurately assessing mobile authentication, and use those metrics to drive the design of new authentication systems.

The project is motivated by the following observations: 1) people are switching from desktops to smartphones as their main computing and Internet platform, 2) mobile platforms provide opportunities for ingenious authentication methods, and 3) although the scientific and engineering community is producing many solutions to mobile authentication, the underlying trade-offs and science behind mobile authentication are not well understood. This project uniquely integrates research and education and promotes underrepresented students in Science, Technology, Engineering and Mathematics (STEM) in K-12, high school, undergraduate and graduate studies. This is an interdisciplinary project that leverages several disciplines including security engineering, mobile computing and human-computer interaction. This project will advance fundamental knowledge on user authentication and security. Towards that end, the project will 1) develop a framework grounded in statistical error analysis for evaluating user authentication systems, 2) create guidelines on how to evaluate and design experiments to ensure comparability and reproducibility, 3) study the cognitive processes that impact secret-knowledge based authentication systems, 4) design, prototype, and implement, novel lightweight mobile-friendly authentication systems, and 5) explore innovative approaches that prevent cognitive overload and ensure security while mobile.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

PUBLICATIONS PRODUCED AS A RESULT OF THIS RESEARCH

Note:  When clicking on a Digital Object Identifier (DOI) number, you will be taken to an external site maintained by the publisher. Some full text articles may not yet be available without a charge during the embargo (administrative interval).

Some links on this page may take you to non-federal websites. Their policies may differ from this site.

Sugrim, Shridatt and Liu, Can and McLean, Meghan and Lindqvist, Janne "Robust Performance Metrics for Authentication Systems" Network and Distributed Systems Security (NDSS) Symposium 2019 , 2019 https://dx.doi.org/10.14722/ndss.2019.23351 Citation Details
Gao, Xianyi and Yang, Yulong and Liu, Can and Mitropoulos, Christos and Lindqvist, Janne and Oulasvirta, Antti "Forgetting of Passwords: Ecological Theory and Data" 27th USENIX Security Symposium (USENIX Security 2018) , 2018 Citation Details
Sugrim, Shridatt and Liu, Can and Lindqvist, Janne "Recruit Until It Fails: Exploring Performance Limits for Identification Systems" Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies , v.3 , 2019 10.1145/3351262 Citation Details

PROJECT OUTCOMES REPORT

Disclaimer

This Project Outcomes Report for the General Public is displayed verbatim as submitted by the Principal Investigator (PI) for this award. Any opinions, findings, and conclusions or recommendations expressed in this Report are those of the PI and do not necessarily reflect the views of the National Science Foundation; NSF has not approved or endorsed its content.

The project made significant advances in the science of security for mobile user authentication.

The research community has produced many types of authentication and identification systems. However, there is no consistent approach for reporting the performance of these systems. Further, this project has shown that the reported metrics are often inadequate.

We found that common metrics for reporting the performance of authentication systems are flawed. This means that published authentication systems may not actually work well because the metrics used in the research were not sufficient. This can have real-life consequences in authentication systems that are adopted based on misleading metrics. Further, we developed a method that overcomes this limitation and gives researchers and consumers of research the ability to reach accurate conclusions about the efficacy of their systems.

We studied how the performance of identification systems can be misleading. The research community has previously studied identification systems with relatively low number of human participants. In this project, we showed how such work fails to generalize and often gives misleading performance results. We designed a diagnostic method that can help to identify whether a model is sensitive to the number of participants.

This project trained several undergraduate and graduate students. The students have learned several important interdisciplinary science and engineering skills during this project. Many of the students involved were underrepresented in STEM disciplines.


Last Modified: 01/28/2021
Modified by: Janne Lindqvist

Please report errors in award information by writing to: awardsearch@nsf.gov.

Print this page

Back to Top of page