A behavioral biometric challenge and response approach to user authentication on smartphones

Behavioral biometrics derived from the fingertip movement on the touchscreen of a mobile device is a promising new authentication technique. A user is verified by the inherent, unique characteristics of the fingertip movement. In this paper, we present a novel verification system that combines these biometrics with a challenge and response type of authentication. The key feature of our technique is that it does not rely on any secret graphical password or gesture. Instead, the user is asked to perform a different, simple challenge on the touchscreen at each login attempt. The novel technique is therefore robust against replay and “smudge” attacks. Additionally, it does not require the user to remember any kind of secret password. We utilize pattern recognition techniques to extract unique behavioral characteristics of an individual. In a user study, we achieved an accuracy of 90% using our system with a single finger gesture, that can be performed in less than three seconds.