Improving Security of Internet Services through Continuous and Transparent User Identity Verification
Reliable Distributed Systems, IEEE Symposium on (2012)
Irvine, CA, USA USA
Oct. 8, 2012 to Oct. 11, 2012
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SRDS.2012.38
Session management in distributed Internet services is traditionally based on username and password, and explicit logouts and timeouts that expire due to idle activity of the user. Emerging biometric solutions allow substituting username and password with biometric data, but still a single verification is deemed sufficient, and the identity of a user is considered immutable during the entire session. Additionally, the length of the timeout may impact on the usability of the service and consequent client satisfaction. This paper explores promising alternatives offered by biometrics for the management of sessions. A secure protocol is defined for perpetual authentication through continuous user verification. The protocol determines adaptive timeouts selected on the basis of the quality, frequency and type of biometric data acquired transparently from the user. Protocol behavior is shown through simulations.
web service, security, continuous authentication, session management, biometrics, CASHMA, mobile devices
A. Ceccarelli, A. Bondavalli, F. Brancati and E. L. Mattina, "Improving Security of Internet Services through Continuous and Transparent User Identity Verification," 2012 IEEE 31st International Symposium on Reliable Distributed Systems (SRDS 2012)(SRDS), Irvine, CA, 2012, pp. 201-206.