Personalized Image-based User Authentication using Wearable Cameras

TL;DR

This paper presents a novel personalized image-based user authentication method using wearable cameras that generates memorable, scene-specific passwords from egocentric videos, enhancing security and usability.

Contribution

It introduces a new authentication approach leveraging first-person videos and eye tracking to create dynamic, personalized graphical passwords for mobile device security.

Findings

Effective scene segmentation and clustering for password generation

Comparable login effort to static challenge methods

Enhanced attack detection with increased time and attempts for attackers

Abstract

Personal devices (e.g. laptops, tablets, and mobile phones) are conventional in daily life and have the ability to store users' private data. The security problems related to these appliances have become a primary concern for both users and researchers. In this paper, we analyse first-person-view videos to develop a personalized user authentication mechanism. Our proposed algorithm generates provisional image-based passwords which benefit a variety of purposes such as unlocking a mobile device or fallback authentication. First, representative frames are extracted from the egocentric videos. Then, they are split into distinguishable segments before a clustering procedure is applied to discard repetitive scenes. The whole process aims to retain memorable images to form the authentication challenges. We integrate eye tracking data to select informative sequences of video frames and suggest a blurriness-based method if an eye-facing camera is not available. To evaluate our system, we perform experiments in different settings including object-interaction activities and traveling contexts. Even though our mechanism produces variable graphical passwords, the log-in effort for the user is comparable with approaches based on static challenges. We verified the authentication challenges in the presence of a random and an informed attacker who is familiar with the environment and observed that the time required and the number of attempts are significantly higher than for the legitimate user, making it possible to detect attacks on the authentication system.