SMAUG: Secure Mobile Authentication Using Gestures

TL;DR

SMAUG is a biometric authentication system for mobile devices that uses multi-sensor data to recognize user gestures with high accuracy and security, supporting flexible input methods like free-form gestures and multi-touch.

Contribution

This paper introduces SMAUG, a novel gesture-based authentication method leveraging multiple sensors, providing high robustness and security without extra hardware.

Findings

77% first-attempt correct identification

99% accuracy after three attempts

97% attacker detection rate

Abstract

We present SMAUG (Secure Mobile Authentication Using Gestures), a novel biometric assisted authentication algorithm for mobile devices that is solely based on data collected from multiple sensors that are usually installed on modern devices -- touch screen, gyroscope and accelerometer. As opposed to existing approaches, our system supports a fully flexible user input such as free-form gestures, multi-touch, and arbitrary amount of strokes. Our experiments confirm that this approach provides a high level of robustness and security. More precisely, in 77% of all our test cases over all gestures considered, a user has been correctly identified during the first authentication attempt and in 99% after the third attempt, while an attacker has been detected in 97% of all test cases. As an example, gestures that have a good balance between complexity and usability, e.g., drawing a two parallel lines using two fingers at the same time, 100% success rate after three login attempts and 97% impostor detection rate were given. We stress that we consider the strongest possible attacker model: an attacker is not only allowed to monitor the legitimate user during the authentication process, but also receives additional information on the biometric properties, for example pressure, speed, rotation, and acceleration. We see this method as a significant step beyond existing authentication methods that can be deployed directly to devices in use without the need of additional hardware.