With the added security provided by LTE, geographical location has become an important factor for authentication to
enhance the security of remote client authentication during mCommerce applications using Smartphones. Tight
combination of geographical location with classic authentication factors like PINs/Biometrics in a real-time, remote
verification scheme over the LTE layer connection assures the authenticator about the client itself (via PIN/biometric) as
well as the client’s current location, thus defines the important aspects of “who”, “when”, and “where” of the
authentication attempt without eaves dropping or man on the middle attacks. To securely integrate location as an
authentication factor into the remote authentication scheme, client’s location must be verified independently, i.e. the
authenticator should not solely rely on the location determined on and reported by the client’s Smartphone. The latest
wireless data communication technology for mobile phones (4G LTE, Long-Term Evolution), recently being rolled out
in various networks, can be employed to enhance this location-factor requirement of independent location verification.
LTE’s Control Plane LBS provisions, when integrated with user-based authentication and independent source of
localisation factors ensures secure efficient, continuous location tracking of the Smartphone. This feature can be
performed during normal operation of the LTE-based communication between client and network operator resulting in
the authenticator being able to verify the client’s claimed location more securely and accurately. Trials and experiments
show that such algorithm implementation is viable for nowadays Smartphone-based banking via LTE communication.
This paper proposes to integrate biometric-based key generation into an obfuscated interpretation algorithm to protect
authentication application software from illegitimate use or reverse-engineering. This is especially necessary for
mCommerce because application programmes on mobile devices, such as Smartphones and Tablet-PCs are typically
open for misuse by hackers. Therefore, the scheme proposed in this paper ensures that a correct interpretation / execution
of the obfuscated program code of the authentication application requires a valid biometric generated key of the actual
person to be authenticated, in real-time. Without this key, the real semantics of the program cannot be understood by an
attacker even if he/she gains access to this application code. Furthermore, the security provided by this scheme can be a
vital aspect in protecting any application running on mobile devices that are increasingly used to perform
business/financial or other security related applications, but are easily lost or stolen. The scheme starts by creating a
personalised copy of any application based on the biometric key generated during an enrolment process with the
authenticator as well as a nuance created at the time of communication between the client and the authenticator. The
obfuscated code is then shipped to the client’s mobile devise and integrated with real-time biometric extracted data of the
client to form the unlocking key during execution. The novelty of this scheme is achieved by the close binding of this
application program to the biometric key of the client, thus making this application unusable for others. Trials and
experimental results on biometric key generation, based on client's faces, and an implemented scheme prototype, based
on the Android emulator, prove the concept and novelty of this proposed scheme.
This paper proposes a new technique to obfuscate an authentication-challenge program (named LocProg) using randomly
generated data together with a client's current location in real-time. LocProg can be used to enable any handsetapplication
on mobile-devices (e.g. mCommerce on Smartphones) that requires authentication with a remote
authenticator (e.g. bank). The motivation of this novel technique is to a) enhance the security against replay attacks,
which is currently based on using real-time nonce(s), and b) add a new security factor, which is location verified by two
independent sources, to challenge / response methods for authentication. To assure a secure-live transaction, thus
reducing the possibility of replay and other remote attacks, the authors have devised a novel technique to obtain the
client's location from two independent sources of GPS on the client's side and the cellular network on authenticator's
side. The algorithm of LocProg is based on obfuscating "random elements plus a client's data" with a location-based
key, generated on the bank side. LocProg is then sent to the client and is designed so it will automatically integrate into
the target application on the client's handset. The client can then de-obfuscate LocProg if s/he is within a certain range
around the location calculated by the bank and if the correct personal data is supplied. LocProg also has features to
protect against trial/error attacks. Analysis of LocAuth's security (trust, threat and system models) and trials based on a
prototype implementation (on Android platform) prove the viability and novelty of LocAuth.
KEYWORDS: Mobile devices, Biometrics, Global Positioning System, Computer security, Binary data, Network security, Receivers, Information security, Mobile communications, Cell phones
Secure wireless connectivity between mobile devices and financial/commercial establishments is mature, and so is the
security of remote authentication for mCommerce. However, the current techniques are open for hacking, false
misrepresentation, replay and other attacks. This is because of the lack of real-time and current-precise-location in the
authentication process. This paper proposes a new technique that includes freshly-generated real-time personal biometric
data of the client and present-position of the mobile device used by the client to perform the mCommerce so to form a
real-time biometric representation to authenticate any remote transaction. A fresh GPS fix generates the "time and
location" to stamp the biometric data freshly captured to produce a single, real-time biometric representation on the
mobile device. A trusted Certification Authority (CA) acts as an independent authenticator of such client's claimed realtime
location and his/her provided fresh biometric data. Thus eliminates the necessity of user enrolment with many
mCommerce services and application providers. This CA can also "independently from the client" and "at that instant of
time" collect the client's mobile device "time and location" from the cellular network operator so to compare with the
received information, together with the client's stored biometric information. Finally, to preserve the client's location
privacy and to eliminate the possibility of cross-application client tracking, this paper proposes shielding the real location
of the mobile device used prior to submission to the CA or authenticators.
The use of mobile communication devices with advance sensors is growing rapidly. These sensors are enabling functions
such as Image capture, Location applications, and Biometric authentication such as Fingerprint verification and Face &
Handwritten signature recognition. Such ubiquitous devices are essential tools in today's global economic activities
enabling anywhere-anytime financial and business transactions. Cryptographic functions and biometric-based
authentication can enhance the security and confidentiality of mobile transactions.
Using Biometric template security techniques in real-time biometric-based authentication are key factors for successful
identity verification solutions, but are venerable to determined attacks by both fraudulent software and hardware. The
EU-funded SecurePhone project has designed and implemented a multimodal biometric user authentication system on a
prototype mobile communication device. However, various implementations of this project have resulted in long
verification times or reduced accuracy and/or security.
This paper proposes to use built-in-self-test techniques to ensure no tampering has taken place on the verification process
prior to performing the actual biometric authentication. These techniques utilises the user personal identification number
as a seed to generate a unique signature. This signature is then used to test the integrity of the verification process. Also,
this study proposes the use of a combination of biometric modalities to provide application specific authentication in a
secure environment, thus achieving optimum security level with effective processing time. I.e. to ensure that the
necessary authentication steps and algorithms running on the mobile device application processor can not be undermined
or modified by an imposter to get unauthorized access to the secure system.
Access to the requested content is limited to institutions that have purchased or subscribe to SPIE eBooks.
You are receiving this notice because your organization may not have SPIE eBooks access.*
*Shibboleth/Open Athens users─please
sign in
to access your institution's subscriptions.
To obtain this item, you may purchase the complete book in print or electronic format on
SPIE.org.
INSTITUTIONAL Select your institution to access the SPIE Digital Library.
PERSONAL Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.