If a researcher wants to contribute in the field of biometric authentication systems (BAS), much manual work is required to gather the current state-of-research (SoR) for a specific type of BAS. Due to loosely structured scientific papers as result reports, all relevant details need to be extracted, aggregated and collected individually. Once the SoR is determined, an exchange with other researchers is hardly possible due to a missing exchange format and they usually have to start from scratch repeating the same inefficient procedure often targeting the same papers. This work presents a domain model for biometric authentication systems and their evaluations, BASE, as a solution. It models and interconnects biometric characteristics, the target architecture, evaluation scenarios, and evaluation criteria grants to represent the most common parts of a BAS. For evaluation, we map 12 BAS approaches from related work into BASE and determine mainly low mapping efforts. In this context, we first identified diverse subsets of BASE being inferable from the analyzed papers. Secondly, most researchers still target rather broad evaluation categories like security or usability instead specific criteria within these categories where the latter would simplify the basic assessment of a BAS. Overall, we consider BASE a promising step to improve the efficiency in SoR determination.

Identifying persons based on their interaction with a door handle has been an active research field in the past years and related work presented promising results. In this context, they instrumented door handles with sensors like accelerometer, gyroscope, or touch and extracted features from complete opening interactions that include pushing down the handle, opening the door, entering the room, and releasing the handle. This work extends existing research with an evaluation whether already the initial door handle’s push-down-phase (PDP) provides sufficient data for behavior-based authentication. For that, recorDOOR was built, a door handle prototype equipped with a camera, accelerometer, gyroscope, four touch stripes, and three ultrasonic distance sensors. We recorded 768 door interactions from eight participants (48 per hand) using recorDOOR, manually labeled the PDP’s start and end, and when the door started moving using our camera stream. We are the first that recorded both hands and also simulated four real-life door opening scenarios including a novel opening careful scenario when standing in front of a door. Our quantitative analysis of the extracted PDPs shows that there is a high variance between PDP durations from less than 40 milliseconds to more than a second and that there are notable differences between left and right hand while opening independent of the scenario. Furthermore, over 95% of our participants started moving the door before the handle was pushed down to its maximum that further shortens the time for a user identification. Based on 235 extracted features and nested 5-fold cross-validation, a Gradient Boosting Classifier performed best and achieved a mean accuracy of 87.92% in an identification scenario for the overall PDP and 82.41% if only considering the PDP before the door is already moved.

Identifying people while entering a room is required to control access to the room but also for personalization in the context of the Internet of Things. Over the last years, several research proposed ways for identification based on the individual door interaction using touch, motion, or computer vision data. Although they reported promising identification accuracies, the results were based on supervised artificial door interaction scenarios were many real world situations are not covered and a decent recording setup is missing yet. This work presents and evaluates DoorCollect, a system to collect interaction data at door handles in an unsupervised way with the help of automated interaction detection and tagging based on BLE beacons, and an alerting and monitoring functionality. Based on a 22 day recording session, we underline its capabilities but also identify further improvement options such as an additional camera-based data verification or a more sensible alerting.

For many years username and password are the common solution to protect sensitive web services despite its various drawbacks. While many alternatives were proposed to improve security, passwords are still included in any authentication procedure today. With the proposal of FIDO and FIDO2/WebAuthn a very promising approach was presented in the last years that may replace passwords at some time since it also enables password-less authentication in addition to work as a second factor for any web authentication. Although FIDO2/WebAuthn solves many problems of passwords using public/private key cryptography and the possibility to use strong authentication mechanisms like biometrics, it is still not capable of detecting an attacker once a successful login has happened. In this paper we evaluate the extension of FIDO2/WebAuthn to enable continuous authentication in the web. While this extension would enable the many proposals of continuous authentication for system or device protection to be used for web authentication, it allows the exchange of the relying parties' security requirements on the one hand and the authenticator's capabilities on the other hand, too. We evaluate our extension using an Android-based roaming authenticator communicating via Bluetooth Low Energy and show that the FIDO2/WebAuthn extension mechanism is suitable. While a real world deployment would require modifications in the different browser implementations, we further point out the challenges resulting from the different implementation levels and the high dynamics in the standard development such as different notification windows or parallelism issues.