Multi-Factor Continuous Authentication of Drivers Leveraging Smartphone

The increased popularity and reliance of users upon car-sharing services necessitates procedures that can continuously and accurately authenticate the drivers so that authorities can associate responsibilities in case of accidents and/or illegal activities involving shared cars. However, the prevalent approaches either are not continuous or fail to offer acceptable accuracy. In view of this, we in this paper aim to use various features offered by smartphones in conjunction with the computational power offered by modern vehicles for enabling Continuous Authentication (CA) of the drivers. To this end, we propose a lightweight protocol that leverages facial recognition, Bluetooth, and a light sensor. The concatenation of the aforementioned features enables us to continuously authenticate users irrespective of the time of the day and without demanding any active participation from the user. To demonstrate the efficacy of our proposed approach, we have implemented a proof-of-concept by leveraging a smartphone, commodity ambient light sensor, Bluetooth module, and a Raspberry Pi as a replica of the car’s computer. Our evaluation suggests the proposed scheme is seamless to operate and achieves high accuracy. Additionally, we also formally analyze our proposed protocol for various attacks via an automatic security analysis tool (i.e., Tamarin) and also emulate such attacks in our experimental setup. Our attack analysis suggests that our protocol is secure against most attacks and thus can be adopted in car-sharing scenarios with high confidence.