Privacy-Preserving Continuous Authentication for Mobile and IoT Systems Using Warmup-Based Federated Learning

Continuous authentication for mobile devices acknowledges users by studying their behavioral interactions with their devices. It provides an extended protection mechanism that supplies an additional layer of security for smartphones and Internet of Things (IoT) devices and locks out intruders in cases of stolen credentials or hijacked sessions. Most of the continuous authentication efforts in the literature consist of collecting behavioral, sensory data from users, and extracting statistical patterns through adopting various Machine Learning (ML) techniques. The main drawback of these approaches is their heavy reliance on acquiring the users' personal data, which exposes the latter's privacy. To address this limitation, we introduce a novel Federated Learning (FL) based continuous authentication mechanism for mobile and IoT devices. Our approach preserves the users' privacy by allowing each individual to locally train an ML model that captures his/her behavior and then shares the model weights with the server for global aggregation. An extended scheme with a warmup FL approach for continuous authentication is proposed. Performance evaluation is done with a unique non-IID dataset built from three well-known datasets: MNIST, CIFAR-10, and FEMNIST. The extensive experimental results show a major accuracy increase in user authentication.

Introduction

Existing mobile and IoT authentication methods depend on the user to input a password, pin, match a pattern, or use Two-Factor authentication methods to access the device. However, these techniques provide #ff0000 access over the system once the session starts. In parallel, the traditional methods cannot implicitly preserve active sessions without repeatedly interrupting the user's workflow to grant him/her access again. Therefore, this approach is not practical in scenarios where user identity needs to be continuously verified. In this context, continuous authentication has been proposed to authenticate the individual's identity who is trying to gain access over a system or entry point on an ongoing, real-time basis. Such a process begins with collecting user behavioral data from device sensors and sending it to an external server, which is processed using ML techniques. The ML trained from the user data can continuously evaluate the interaction behavior with the device and predict the user's identity as a background service without interrupting the user's activities.