CONTINUOUS BIOMETRIC USER AUTHENTICATION MODELS FOR ENHANCING THE SECURITY OF INFORMATION SYSTEMS

Abstract

This paper addresses the problem of enhancing the security of user authentication in information systems based on biometric data acquired from wearable devices. The paper substantiates the expediency of transitioning from one-time (static) identity verification to continuous authentication, in which the legitimacy of the user is confirmed throughout the entire working session. It is shown that one-time identity verification is limited, since after a successful login the open session remains vulnerable to interception and unauthorized use. Fingerprint, heart rate, heart rate variability, blood oxygen saturation, and skin temperature — all available on modern smartwatches — are used as a common set of factors. Four authentication models are proposed and formalized: an adaptive model accounting for contextual risk, an intelligent model based on machine learning, a multimodal authentication model with weighting coefficients, and a context-aware model that additionally takes behavioral factors into account. For each model, a mathematical description and a decision-making scheme are provided, and the advantages and disadvantages are determined in terms of accuracy, spoofing resistance, computational complexity, and the energy consumption of the wearable device. An illustrative numerical example is presented, and an analysis of the models' resistance to the main types of attacks is carried out. A practically reproducible method for selecting weighting coefficients based on the individual error rates of the factors is proposed. A comparative analysis of the models against nine criteria is performed, which makes it possible to reasonably select a model depending on the security requirements, device resources, and operating conditions.