Imagine a quick-fingered thief at a Capitol Hill happy hour, dipping into a government employee\u2019s work bag, and walking away with a new phone.<\/p>\n\n\n\n
That phone could contain more than just old vacation photos, contact information and the like. If it\u2019s a government-issued device, it could also contain access to government emails and other sensitive information.<\/p>\n\n\n\n
But later, as the pickpocket scrolls through the device for personal or financial information, apps stop working. Before long the phone unexpectedly powers off.<\/p>\n\n\n\n
It knows something is not right.<\/p>\n\n\n\n
No one has remotely accessed the phone to preemptively disable it. Instead, the device\u2019s instruments and sensors have been watching the user\u2019s unique physical and behavioral characteristics, like the way the impostor walks or types, and determined something is amiss.<\/p>\n\n\n\n
The phone\u2019s information is secure and the thief is out of luck.<\/p>\n\n\n\n
That future may not be far off. The government is currently working on a prototype phone that would use biometrics \u2014 those unique physical and behavioral characteristics that can identify an individual \u2014 to constantly verify a user\u2019s identity and quickly pick up on whether an unauthorized user is attempting to gain access.<\/p>\n\n\n\n
Biometric identification is not entirely new to consumers. In 2013, Apple introduced Touch ID, which allowed owners to use fingerprint scanning to unlock their phone. Since then, fingerprint scanning has spread across the industry, and multiple phone manufacturers have made efforts, to varying success, to introduce facial recognition. And it is making traction in the government, as well.<\/p>\n\n\n\n
But the Defense Information Systems Agency wants to take this a step further. A few steps further, actually.<\/p>\n\n\n\n
What the Department of Defense wants, and what DISA is developing, is a persistent authentication method that can continuously monitor an individual and validate their identity through a set of biometrics. <\/p>\n\n\n\n
\u201cWhat we were looking for is that kind of continuous authentication to the device just sitting in the background and, you know, constantly identifying that user\u2019s behavior, authenticating that behavior and comparing it against them,\u201d explained Stephen Wallace, the systems innovation scientist for DISA\u2019s Emerging Technologies Directorate.<\/p>\n\n\n\n
\u201cIf I had a profile of that user, and another user were to stand in order to take control, we want to be able to detect the fact that that happened in an unobtrusive manner and shut that session down or create additional challenges to the user.\u201d<\/p>\n\n\n\n
The most widely used authentication method is the Common Access Card, but it falls short of that lofty goal. <\/p>\n\n\n\n
\u201cWe\u2019ve had the Common Access Card within the department for more than 15 years, and it\u2019s served us well. It\u2019s still a really strong method for authentication. But the reality is, it\u2019s really just a point in time type of thing, right? I stick my Common Access Card in, I type in my PIN, I authenticate to the system or service, and away I go,\u201d said Wallace.<\/p>\n\n\n\n
DISA has had some success in translating the Common Access Card to the mobile world through its Purebred solution. Purebred uses the Common Access Card to essentially credential individual mobile devices, like a phone, so users can access more secure information and applications.<\/p>\n\n\n\n
As of April, Purebred was providing over-the-air credentials to more than 100,000 DoD-issued commercial mobile devices.<\/p>\n\n\n\n
The Common Access Card system is useful, but it is imperfect. Unauthorized users can gain access with someone else\u2019s card if they know the PIN, or if someone leaves a station that\u2019s logged in, someone else can hop onto that device. The Purebred solution helps extend that system to mobile devices, but it suffers from some of the same issues. Once a device is credentialed it can still be physically stolen and accessed if the user was logged in. It still doesn\u2019t provide the constant user verification DISA wants.<\/p>\n\n\n\n
Biometrics hold the promise to solve the problem. DISA\u2019s Emerging Technologies Directorate is currently working on just such a solution, and they\u2019ve already developed and tested a prototype phone.<\/p>\n\n\n\n
\u201cIt all started about two years ago with a prototype that we did on the desktop, where we watched the users\u2019 behavior, with the way that they interacted with the machine. So, we watched … their dwell time with keys on the keyboard,\u201d said Wallace. \u201cIt was really building a model of the behavior of how they interacted with the machine. So, we had a reasonable amount of success there. And then we decided to move from there, on to the mobile side of things.\u201d<\/p>\n\n\n\n
DISA has even learned how to use phones to identify unique gaits \u2014 the way an individual walks \u2014 by leveraging the device\u2019s accelerometer and gyroscope. Wallace said the prototype can develop a unique profile of an individual\u2019s gait after just 100 yards of walking while carrying the device.<\/p>\n\n\n\n
The prototype can then adapt to slight changes in behavior \u2014 from a task as simple as switching which pocket the subject carried their phone in to if the subject started limping after stubbing their toe.<\/p>\n\n\n\n
\u201cBasically, in that particular prototype, it was constantly refreshing the model, but it would also maintain several models to ensure that as things changed, it was able to adapt,\u201d said Wallace.<\/p>\n\n\n\n
The prototype uses all that biometric information to create a profile of the user. It then compares ongoing behavior of the user against that profile to assess a risk score \u2014 essentially registering how confident it is that the user is who they\u2019re supposed to be. The device will then allow different levels of access based on the risk score. If the device is confident that the user is who they say they are, it will allow full access to programs such as encrypted email. But the less confident the device is in the user\u2019s identity, the more likely it will cut off access to more secure or sensitive programs and information.<\/p>\n\n\n\n
The device is also programmed to apply contextual clues, such as GPS location, connection to trusted networks and other peripherals, to further verify the user\u2019s identity.<\/p>\n\n\n\n
According to Wallace, all the data that makes up that profile is stored locally. That means every time a user gets a new device, they have to re-enroll in the program and develop that profile all over again. Wallace added that as this technology matures it could eventually fit into a smaller or less obtrusive form factor, like a watch or other wearable.<\/p>\n\n\n\n
Importantly, the goal for DISA was to design something that would be adopted commercially, he said.<\/p>\n\n\n\n
\u201cThe partnership with the commercial world was really important to us, because we didn\u2019t want to end up with a one-off, DoD type of outcome where we\u2019re paying thousands of dollars per handset in some cases,\u201d he said.<\/p>\n\n\n\n
\u201cWe went this way because there is a side benefit commercially. It benefits us from a cost perspective, but we think that this type of this type of thing is beneficial in the commercial market, as well.\u201d <\/p>\n\n\n\n
Wallace said he hopes to see the technology available commercially within the 18 months to two years.<\/p>\n","protected":false},"excerpt":{"rendered":"
The Defense Intelligence Agency\u2019s Emerging Technologies Directorate has a prototype phone that uses biometrics to constantly verify the user’s identity.<\/p>\n","protected":false},"author":7,"featured_media":39664,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":15,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,11,62,29,15,32,25],"tags":[],"coauthors":[3143],"class_list":["post-19095","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-disa","category-disa-forecast-industry","category-home","category-intel-geoint","category-newsletters","category-show-reporter"],"acf":{"subheadline":"","legacy_arc_id":"AOF3PQFU6VCKXLCN6TFTCYDCGI","arc_canonical_url":"\/intel-geoint\/2019\/11\/04\/disa-wants-to-know-that-its-you-carrying-your-phone\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n