Eye tracking devices have recently become increasingly popular as an interface between people and cons-umer-grade electronic devices. Due to the fact that human eyes are fast, responsive, and carry information unique to an individual, analyzing person’s gaze is particularly attractive for rapid biometric authentication. Unfortunately, previous proposals for gaze-based authentication systems either suffer from high error rates or requires long authentication times. We build on the fact that some eye movements can be reflexively and predictably triggered and develop an interactive visual stimulus for elicitation of reflexive eye movements that support the extraction of reliable biometric features in a matter of seconds, without requiring any memorization or cognitive effort on the part of the user. As an important benefit, our stimulus can be made unique for every authentication attempt and thus incorporated in a challenge-response biometric authentication system. This allows us to prevent replay attacks, which are possibly the most applicable attack vectors against biometric authentication. Using a gaze tracking device, we build a prototype of our system and perform a series of systematic user experiments with 30 participants from the general public. We thoroughly analyze various system parameters and evaluate the performance and security guarantees under several different attack scenarios. The results show that our system matches or surpasses existing gaze-based authentication methods in achieved equal error rates (6.3%) while achieving significantly lower authentication times (5s).

中文翻译：

---

快速抗重放生物特征认证的反射性眼动分析

作为人与消费级电子设备之间的接口，眼动追踪设备最近变得越来越流行。由于人眼速度快、反应灵敏且携带个人独有的信息，因此分析人的注视对于快速生物特征认证特别有吸引力。不幸的是，以前的基于注视的身份验证系统的提议要么受到高错误率的影响，要么需要很长的身份验证时间。我们建立在这样一个事实的基础上，即一些眼球运动可以被反射性和可预测地触发，并开发出一种交互式视觉刺激，以引发反射性眼球运动，支持在几秒钟内提取可靠的生物特征，而无需任何记忆或认知努力。部分用户。作为一个重要的好处，我们的刺激可以为每次身份验证尝试设置唯一的，因此并入挑战-响应生物特征身份验证系统中。这使我们能够防止重放攻击，这可能是针对生物特征认证的最适用的攻击向量。使用凝视跟踪设备，我们构建了系统的原型，并与来自公众的 30 名参与者进行了一系列系统的用户实验。我们深入分析了各种系统参数，并评估了几种不同攻击场景下的性能和安全保障。结果表明，我们的系统在实现相同的错误率 (6.3%) 方面匹配或超过了现有的基于注视的身份验证方法，同时显着降低了身份验证时间 (5s)。