Abstract:<p>Mobile devices have brought a great convenience to us these years, which allow the users to enjoy the anytime and anywhere various applications such as the online shopping, Internet banking, navigation and mobile media. While the users enjoy the convenience and flexibility of the "Go Mobile" trend, their sensitive private information (e.g., name and credit card number) on the mobile devices could be disclosed. An adversary could access the sensitive private information stored on the mobile device by unlocking the mobile devices. Moreover, the user's mobile services and applications are all exposed to security threats. For example, the adversary could utilize the user's mobile device to conduct non-permitted actions (e.g., making online transactions and installing malwares). The authentication on mobile devices plays a significant role to protect the user's sensitive information on mobile devices and prevent any non-permitted access to the mobile devices. This paper surveys the existing authentication methods on mobile devices. In particular, based on the basic authentication metrics (i.e., knowledge, ownership and biometrics) used in existing mobile authentication methods, we categorize them into four categories, including the knowledge-based authentication (e.g., passwords and lock patterns), physiological biometric-based authentication (e.g., fingerprint and iris), behavioral biometrics-based authentication (e.g., gait and hand gesture), and two/multi-factor authentication. We compare the usability and security level of the existing authentication approaches among these categories. Moreover, we review the existing attacks to these authentication approaches to reveal their vulnerabilities. The paper points out that the trend of the authentication on mobile devices would be the multi-factor authentication, which determines the user's identity using the integration (not the simple combination) of more than one authentication metrics. For example, the user's behavior biometrics (e.g., keystroke dynamics) could be extracted simultaneously when he/she inputs the knowledge-based secrets (e.g., PIN), which can provide the enhanced authentication as well as sparing the user's trouble to conduct multiple inputs for different authentication metrics.</p>

PROTECT: Efficient Password-Based Threshold Single-Sign-On Authentication for Mobile Users against Perpetual Leakage

A PRIVACY-PRESERVING AUTHENTICATION SCHEME USING BIOMETRICS FOR PERVASIVE COMPUTING ENVIRONMENTS

Authentication scheme based on biometric encryption for pervasive computing environments

A Lightweight Three-Factor User Authentication Protocol for the Information Perception of IoT

A Threshold Multi-server Protocol for Password-Based Authentication.

A secure and efficient user authentication protocol for two-tiered wireless sensor networks

Opass: A User Authentication Protocol Resistant to Password Stealing and Password Reuse Attacks.

User authentication on mobile devices: Approaches, threats and trends

On the Challenges in Designing Identity-Based Privacy-Preserving Authentication Schemes for Mobile Devices

A DYNAMIC PASSWORD AUTHENTICATION FOR REMOTE USERS IN INSECURE CHANNEL

SIMulation: Demystifying (insecure) Cellular Network Based One-Tap Authentication Services

Amogap: Defending Against Man-In-The-Middle And Offline Guessing Attacks On Passwords

Hardening Password-Based Credential Databases

Secure Session on Mobile: an Exploration on Combining Biometric, Trustzone, and User Behavior

PassApp: My App is My Password!

An efficient dynamic ID based remote user authentication scheme using self-certified public keys for multi-server environment

An Interactive and Secure User Authentication Scheme for Mobile Devices.

Breaking Three Remote User Authentication Systems for Mobile Devices

A novel OTP based tripartite authentication scheme

On the Security of Some Password Authentication Protocols.

Advances in Password Security