UFace: Your universal password that no one can see. Issue 77 (August 2018)

• Record Type: Journal Article
• Authors: Lin, Dan; Hilbert, Nicholas; Storer, Christian; Jiang, Wei; Fan, Jianping
• Is Part Of: Computers & security. Issue 77(2018)
• Page Start: 627
• Page End: 641
• Publication Date: 2018-08
• Subjects: Face authentication -- Privacy preservation -- Android application -- Secure multi-party computation -- Impersonation attack; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.09.016
• Languages: English
• ISSNs: 0167-4048

Abstract

Highlights: UFace ensures that the plaintext of bio-information is kept only at the user side during the authentication process. Another unique contribution of our work is that we discovered that using special close-up facial images would be able to prevent attackers from using facial images published in social network sites to impersonate the true user. We developed an Android application that is capable of efficient photo feature extraction and encryption and keeps each users' computational burden to minimum. The development of the Android application involved multiple challenges that dealt with the limited memory/computing power of these mobile devices along with the need to design a new library for facial feature generation tailored to work on mobile device. Our proposed approach has been evaluated both theoretically and experimentally. The security analysis shows that UFace is robust against various types of attacks. The experimental results demonstrate that UFace not only can correctly authenticate a user, but also can be done within seconds which is significantly faster than any existing privacy preserving authentication protocol. Abstract: Due to the ease of use, face authentication could be a promising way to replace hard-to-remember passwords to access web services. However, to make face authentication suitable for web services, there are still several critical security and privacy challenges unaddressed. First, the existing authentication servers typically collect the plaintext of users' facial images in order to conduct authentication. If the servers are compromised, the attackers would obtain the users' facial images and can easily impersonate the users in any other applications that use face authentication. Second, it is also hard to prevent attackers from using facial images published in social network sites to impersonate the true user. In this paper, we conquered these two issues by proposing a novel secure face authentication system, called UFace. UFace uses special close-up facial images (which cannot be found online) for authentication. To further ensure the confidentiality of these close-up images, UFace guarantees that these images are only stored at user side and the servers have not any plaintext of these images. The face authentication is conducted securely with two collaborative authentication servers. UFace was implemented through both an Android application and multiple server side programs which were then evaluated in a real setting. The experimental results demonstrate that the UFace system can accurately authenticate users within a few seconds.