Recent hardware advances have led to the development and consumerization of mobile devices, which mainly include smartphones and various wearable devices. To protect the privacy of users, various user authentication mechanisms have been proposed. In particular, biometrics has been widely used for multi-factor authentication. However, biometrics-based authentication mechanisms usually require costly sensors deployed on devices, and rely on explicit user input and Internet connection for performing user authentication. In this article, we propose a system, called RiskCog, which can authenticate the ownership of mobile devices unobtrusively and in a real-time manner by adopting a learning-based approach. Unlike previous studies on user authentication, for cross-platform deployment, maximum user privacy protection, and unobtrusive authentication, RiskCog only relies on those widely available and privacy-insensitive motion sensors to capture the data related to the users’ daily device usage. It requires no users’ explicit input and has no requirement on the users’ motion state or the device placement. RiskCog is also usable in the environment without Internet access by performing offline user identity verification. We conduct comprehensive experiments on smartphones and smartwatches, which show that RiskCog can authenticate device users rapidly and with high accuracy.

中文翻译：

---

RiskCog：野外移动设备上不显眼的实时用户身份验证

最近的硬件进步导致了移动设备的开发和消费化，主要包括智能手机和各种可穿戴设备。为了保护用户的隐私，已经提出了各种用户认证机制。特别是，生物识别技术已被广泛用于多因素身份验证。然而，基于生物识别的身份验证机制通常需要在设备上部署昂贵的传感器，并依赖显式的用户输入和互联网连接来执行用户身份验证。在本文中，我们提出了一个名为 RiskCog 的系统，该系统可以通过采用基于学习的方法以不显眼的方式实时验证移动设备的所有权。不同于以往对用户认证的研究，对于跨平台部署、最大程度的用户隐私保护、不显眼的认证，RiskCog 仅依靠那些广泛使用且对隐私不敏感的运动传感器来捕获与用户日常设备使用相关的数据。它不需要用户的明确输入，也不需要用户的运动状态或设备放置。通过执行离线用户身份验证，RiskCog 也可以在没有 Internet 访问的环境中使用。我们在智能手机和智能手表上进行了全面的实验，结果表明 RiskCog 可以快速、准确地对设备用户进行身份验证。通过执行离线用户身份验证，RiskCog 也可以在没有 Internet 访问的环境中使用。我们在智能手机和智能手表上进行了全面的实验，结果表明 RiskCog 可以快速、准确地对设备用户进行身份验证。通过执行离线用户身份验证，RiskCog 也可以在没有 Internet 访问的环境中使用。我们在智能手机和智能手表上进行了全面的实验，结果表明 RiskCog 可以快速、准确地对设备用户进行身份验证。