Toward Robust Detection of Puppet Attacks via Characterizing Fingertip-Touch Behaviors

This is the authors' abstract. We don't add key points for this paper.

Fingerprint authentication has gained increasing popularity on mobile devices in recent years. However, it is vulnerable to presentation attacks, which include that an attacker spoofs with an artificial replica. Many liveness detection solutions have been proposed to defeat such presentation attacks; however, they all fail to defend against a particular type of presentation attack, namelypuppet attack, in which an attacker places an unwilling victim's finger on the fingerprint sensor. In this article, we proposeFinAuth, an effective and efficient software-only solution, to complement fingerprint authentication by defeating both synthetic spoofs and puppet attacks usingfingertip-touchcharacteristics.FinAuthcharacterizes intrinsic fingertip-touch behaviors including the acceleration and the rotation angle of mobile devices when a legitimate user authenticates.FinAuthonly utilizes common sensors equipped on mobile devices and does not introduce extra usability burdens on users. To evaluate the effectiveness ofFinAuth, we carried out experiments on datasets collected from 90 subjects after the IRB approval. The results show thatFinAuthcan achieve the average balanced accuracy of 96.04% with 5 training data points and 99.28% with 100 training data points. Security experiments also demonstrate thatFinAuthis resilient against possible attacks. In addition, we report the usability analysis results ofFinAuth, including user authentication delay and overhead.