Towards Application-Centric Implicit Authentication on

Implicit authentication schemes are a secondary authentica-tion mechanism that provides authentication by employing unique patterns of device use that are gathered from smart-phone users without requiring deliberate actions. Contem-porary implicit authentication schemes operate at the de-vice level such that they neither discriminate between data from different applications nor make any assumption about the nature of the application that the user is currently us-ing. In this paper, we challenge the device-centric approach to implicit authentication on smartphones. We argue that the conventional approach of misuse detection at the de-vice level has inherent limitations for mobile platforms. To this end, we analyze and empirically evaluate the device-centric nature of implicit authentication schemes to show their limitations in terms of detection accuracy, authentica-tion overhead, and fine grained authentication control. To mitigate these limitations and for effective and pragmatic implicit authentication on the mobile platform, we propose a novel application-centric implicit authentication approach. We observe that for implicit authentication, an application knows best on when to authenticate and how to authenti-cate. Therefore, we delegate the implicit authentication task to the application and let the application provider decide when and how to authenticate a user in order to protect the owner’s personal information. Our proposed application-centric implicit authentication approach improves accuracy and provides fine grained authentication control with low authentication overhead. Future research in this domain will benefit from our findings to provide pragmatic implicit authentication solutions. 1