Francesco Buccafurri

Gianluca Lax
email: lax@unirc.it

Denis Migdal
email: denis.migdal@ensicaen.fr

Serena Nicolazzo
email: s.nicolazzo@unirc.it

Antonino Nocera
email: a.nocera@unirc.it

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Contrasting False Identities in Social Networks by Trust Chains and Biometric Reinforcement

Keywords: Social networks, trust, keystroke dynamics

Fake identities and identity theft are issues whose relevance is increasing in the social network domain. This paper deals with this problem by proposing an innovative approach which combines a collaborative mechanism implementing a trust graph with keystroke-dynamic-recognition techniques to trust identities. The trust of each node is computed on the basis of neighborhood recognition and behavioral biometric support. The model leverages the word of mouth propagation and a settable degree of redundancy to obtain robustness. Experimental results show the benefit of the proposed solution even if attack nodes are present in the social network.

I. INTRODUCTION

Social network profiles whose claimed identity does not match with the real user are certainly potential security threats in the Web [START_REF] Nosko | All about me: Disclosure in online social networking profiles: The case of facebook[END_REF]. This happens in two cases. The first case is that of fake profiles, in which the owner of a profile intentionally claims the real-life identity of another individual.

The second case is that of violated profiles, in which an intruder, permanently or temporarily, uses the profile of a victim in a fraudulent way.

In both cases, the risk of anomalous behavior with potential damage of the victim reputation, espionage, or social engineering attacks towards people connected to the victim is very high. To give an example, according to security firm Symantec [START_REF]BBC News[END_REF], a growing number of hackers are targeting professionals on LinkedIn. Through these connections, attackers can entice users to give up personal data, hijack them towards infected websites and, once their email addresses is known, launch spear-phishing campaigns.

The problem has thus a high practical relevance. A number of studies have been proposed in the recent literature [START_REF] Graham | Detecting fake-good and fake-bad mmpi-2 profiles[END_REF], [START_REF] Conti | Fakebook: Detecting fake profiles in on-line social networks[END_REF] to contrast this problem. However, all the existing proposals require a strong effort of analysis done centrally by the social network provider, which takes into account all the behavioral and topological information of the profiles.

In this paper, we offer a different approach based on a collaborative trust mechanism that may operate in principle in a truly distributed fashion, combined with behavioral biometric methods to contrast profile compromising. The originality of our proposal is that it only leverages user-to-user interactions, and no information that only the social network provider can have. Moreover, we adopt a conservative approach, because our goal is to provide assurance that a profile is genuine instead of detecting fake profiles. The underlying idea exploits the social structure of our domain: Indeed, the trust model is based on a robust implementation of a worth of mouth approach and robustness is obtained by redundancy. In words, we follow the principle that if a sufficient number of people trust the identity of a social network profile, we can trust it too. This way, we obtain a graph of trust, because we propagate trust under the basic assumption that a fake user (and then fake behavior) is transitively excluded. We base our assumption on the consideration that, when the real-life identity is known, sanctions are facilitated in case of misbehavior (e.g., victims might sue users who certified the offender), thus misbehavior is prevented.

Trust is obtained through redundant trust chains in which any node plays a role similar to an intermediate certifier in a certificate chain, until a certified profile is reached. In our model, indeed, the presence of some profiles certified by a Trusted Third Party is also required. In order to identify possible intrusions in a legitimate profile, the trust model takes also into account the behavioral biometric traits of users that they record and verify in a peer-to-peer fashion (i.e., no storing of biometric data is required to the social network provider). In other words, the word of mouth mechanism propagates the information that the current behavior of a given node is not compliant with that of the initial safe state, thus reducing the trust of the community towards that node. We use in this paper keystroke dynamics as behavioral biometric modality. This information is very easy to collect on web pages (e.g., by using a JavaScript code) and allows a simple and low cost solution to verify the identity of one user [START_REF] Messerman | Continuous and non-intrusive identity verification in real-time environments based on free-text keystroke dynamics[END_REF], [START_REF] Song | A continuous identity verification method based on free-text keystroke dynamics[END_REF], [START_REF] Mondal | Person identification by keystroke dynamics using pairwise user coupling[END_REF].

The structure of the paper is the following. In the next section, we contextualize our proposal in the state of the art. In Section III, we describe our model and the related methodology, by giving general principles, the behavioral biometric modality used in our approach, and the theoretical support of the trust mechanism. In Section IV, we test our methodology. Finally, in Section V, we draw our conclusions and discuss the future work.

II. RELATED WORKS

Identity theft in Online Social Networks (OSNs) is becoming a significantly growing concern [START_REF] Nosko | All about me: Disclosure in online social networking profiles: The case of facebook[END_REF]. Threats vary from terrorism to scamming, spear phishing, trolling, and so on.

Typical solutions for identity deception attacks rely on legitimate community members and administrators who are called to manually identify malicious accounts [START_REF] Tsikerdekis | Detecting and preventing online identity deception in social networking services[END_REF]. Whereas, automatic solutions focusing on verbal and non-verbal approaches for identity deception detection have been proposed in [START_REF] Tsikerdekis | Identity deception prevention using common contribution network data[END_REF], [START_REF] Wang | Automatically detecting criminal identity deception: an adaptive detection algorithm[END_REF]. In particular, in [START_REF] Tsikerdekis | Identity deception prevention using common contribution network data[END_REF] the authors present a computational solution of deception prevention that uses social network data and a common contribution network. This machine learning based solution can not be applied to our scenario because it focuses on proactively disabling the ability of a deceiver to cause disruption in a social media platform preventing the access only to a sub-community of an OSN. Hence, it protects only the identity of a user belonging to a given group of an OSN. In [START_REF] Jin | Towards active detection of identity clone attacks on online social networks[END_REF], the authors propose two detection schemes to discover potential faked identities in OSNs. These schemes help to resist Identity Clone Attacks (ICA), where the adversary forges the victim's identity and creates a profile with the same information and circles as friends of the victim.

The approach described in [START_REF] Bilge | All your contacts are belong to us: automated identity theft attacks on social networks[END_REF] shows that enhanced forms of ICA can be carry out, for instance the adversary can also implement an automated, cross-site profile cloning attack, if the attacker can forge the identity of the victim on another OSN site in which the victim is not registered yet. In [START_REF] Cutillo | Safebook: A privacy-preserving online social network leveraging on real-life trust[END_REF] the authors propose Safebook, a decentralized and privacy-preserving OSN. This system provides registered users with data storage and data management functions relying on trust relationships that are part of social networks in real life. A similar system is presented in [START_REF] Baden | Persona: an online social network with user-defined privacy[END_REF]. In this platform, users are associated with public keys they exchange out of band while creating OSN links, and data confidentiality and privacy are ensured through encryption. These systems do not protect from identity theft on the original OSN, but their aim is to provide a tool to anonymously communicate through hop-by-hop encryption among trusted users.

Our approach is also related to the concept of information diffusion in OSNs, in the sense that the roots influence the trust values of other nodes in the network following the rules of OSN information flow [START_REF] Bakshy | The role of social networks in information diffusion[END_REF], [START_REF] Peng | Social influence modeling using information theory in mobile social networks[END_REF]. Most of these works study how information flows in OSNs and propose strategies to maximize this diffusion by identifying strategical nodes for the information propagation. The aim of our paper is somehow orthogonal to these studies and may exploit these solutions to improve trust propagation through the OSN.

Moreover, our approach leverages biometric data, which is a practice not new for social networks applications [START_REF] Li | Chapter 5 biometrics in social media applications[END_REF]. Most of the papers focus on user authentication using biometric data in order to enhance its security. Some papers in the literature considered soft biometrics with possible applications to social networks. Most of the works consider gender recognition by analyzing the type of images posted or the keystroke dynamics [START_REF] Gadiya | Gender prediction using images posted on online social networks[END_REF], [START_REF] Tsimperidis | Age detection through keystroke dynamics from user authentication failures[END_REF]. To our knowledge, no work considered keystroke dynamics as solution for continuous authentication for enhancing trust in social networks.

Several works exploit biometrics to implement continuous authentication schemes [START_REF] Deutschmann | Continuous authentication using behavioral biometrics[END_REF], [START_REF] Upadhyaya | Continuous authentication using behavioral biometrics[END_REF], [START_REF] Schiavone | Continuous user identity verification for trusted operators in control rooms[END_REF], [START_REF] Mondal | Continuous authentication using behavioural biometrics[END_REF]. Indeed, in highsecurity environments the typical session level authentication can be exposed to session hijacking in which an attacker targets a post-authenticated session. In those scenarios, continuous and real-time verification of user identity may become mandatory and a lot of research effort has been devoted to use biometrics as a mean to achieve this objective. However, the goal of these strategies is very far away from ours. Indeed, our approach does not aim at proposing a strategy to continuously verify that an active login session is controlled by the right user; instead, our approach exploits biometric data as a feedback to our trust model to measure the trustworthiness of an online profile.

III. PROPOSED METHOD A. General principle

The reference scenario is that of a social network. The approach works by considering trust chains among users. Each chain starts from a root profile, which is a profile certified by a Trusted Third Party (TTP). To build a certified profile (root profile), a user has to register to the social network via TTP (also by exchanging identification documents or using a public digital identity system). In this phase, TTP gathers the biometric (behavioral) parameters of the user to create a model that will be exploited, in the future interaction with the user, to verify whether the account is still under this user control. In the negative case, the profile will be no longer certified.

We represent a social network as a directed graph G = N, E , where N is the set of profiles, and E models friendship among social network profiles. To be general, we use the notion of directed graphs, so that the case of symmetric friendship (as Facebook) is simply handled by including two edges in both directions.

N is thus partitioned into two subsets: the set of certified nodes (denoted by N c ), and the set of non-certified nodes. Any node of the social network (both certified and noncertified) may directly recognize some of its direct contacts. The underlying idea is that a node recognizes only those adjacent nodes for which past real-life interactions occurred, allowing to conclude, also by using external knowledge, that the claimed identity is not fake (this typically happens for a significant portion of social network contacts). When a safe interaction occurs (for example, at the first message exchange allowing to recognizes the interlocutor) the profile playing the role of recognizer builds a biometric model of the recognizing node, in order to detect, in the future, the possible presence of an intruder. Importantly, only a node already recognized can play the role of recognizer. The underlying rationale is that the misbehavior of a user is directly connected to his/her anonymity in the social network. In other words, making the recognizing process fully accounted and traced (and related to a real-life identity), we can increase the trust about recognized identities, provided that transitively, the process leads to root nodes. As we cannot give an absolute value to the principle above, we have to increase the level of trust by requiring redundancy in the recognizing process, thus making more improbable the conjunct misbehavior of identified recognizers. The level of redundancy sets the level of trust. The biometric model built by any participant, allows us to detect possible profile compromising, thus including in the trust also the expectation that an initially identified profile is still under the exclusive control of the legitimate owner. It is worth noting that, in principle, the biometric model could be learned by means of multiple channels (social network interactions, chats, shared editing, and so on) by associating the model to the asserted identity.

Before giving into detail, we remark that the proposed approach is not aimed to define a digital identity system, since, as already observed, only a level of trust is obtained and, further, it regards not all identifying data. Indeed, when a user a recognizes a user b, she/he is stating just that b is not claiming an identity not belonging to him, not the veracity of all published information. The number and quality of information needed to a to reach this conclusion depend on the social context. Besides name and surname, they may regard the job, the age, the friends, etc. A detailed study of these aspects is out of the scope of this paper whose aim is just to define the basic approach, leaving the detail (also for example the case of multiple profiles of the same user, that of social network profiles managed by more people, etc.) to future work.

B. Keystroke dynamics

Keystroke dynamics is a behavioral biometric modality consisting in analyzing user's way of typing on a keyboard. This biometric information can be computed easily on Internet using a simple JavaScript code. Keystroke dynamics has been experimented for the first time in 1980 in a study where seven secretaries were asked to type three different texts [START_REF] Gaines | Authentication by keystroke timing: some preliminary results[END_REF]. The results were promising, but lacked a sufficient number of users involved in the database. The first patent on keystroke dynamics was registered in 1986 [START_REF] Garcia | Personal identification apparatus[END_REF]. Other methods have been defined during the last twenty years [START_REF] Phoaha | Hidden markov model (hmm)-based user authentication using keystroke dynamics[END_REF].

In previous references such as [START_REF] Giot | Greyc keystroke: a benchmark for keystroke dynamics biometric systems[END_REF], it has been shown that keystroke dynamics is invariant to the keyboard type (laptop or terminal). The use of mobile devices is not considered in this paper but many methods exist to deal with this type of capture [START_REF] Dafer | Evaluation of keystroke dynamics authentication systems: Analysis of physical and touch screen keyboards[END_REF].

The capture process of keystroke dynamics is presented in keys are pressed and released (timestamp of the event, code of the key, . . . ) provided by any Operating System (OS). The feature extraction consists mainly in computing different latencies and duration times between each key. Figure 1 shows an example where the user presses two keys of the keyboard. The user presses "C" at T1, "O" at T2 and releases "C" at T3 and "O" at T4. Note that the following relation is always respected: T 3 > T 1 and T 4 > T 2 (we always release a key after pressing it), while the following condition may not always be respected: T 2 > T 3 (because, as in our example, a user may press another key before releasing the previous one). We can extract three different types of latencies (T2-T1, T4-T3,T2-T3) which we call PP (latency between two pressures), RR (latency between two releases), RP (latency between one release and one pressure) respectively and one type of duration (T3-T1 or T4-T2) which we call PR (duration of a key press). The described process is repeated for all the keys. Keystroke dynamics can be used either with passwords to enhance the security of user authentication or on free text. In this paper, we intend to use it on free text. Subsequently, we consider the different timing information between twocharacter sequences known as digraphs. Digraphs are the latency times between two successive keystrokes. The biometric template associated to user z is composed of n digraphs B z = {b 1 z , .., b n z }. The considered digraphs could be associated to one language. We have to build the user reference biometric template by analyzing keystroke dynamics during a period of time where we assume only the legitimate user interacts with the social network. The reference template of user z is defined by Bz = {E[B z ], σ[B z ]} where E[.] corresponds to the average value of biometric templates of user z and σ[.] the associated standard deviation. To decide if a biometric template B x belongs to user z, we need to compare it with the reference template of user z denoted Bz as follows [START_REF] Hocquet | User classification for keystroke dynamics authentication[END_REF]:

Score = 1 - 1 n n i=1 e -|Bx-E[Bz ]| σ[Bz ]
This score gives a confidence measure the user z is legitimate and will be used in the trust model we propose in the next section.

C. Trust Model

In this section, we describe how our trust model works. Throughout this section consider given a directed graph G = N, E representing a social network and a redundancy parameter t, i.e., a positive integer representing a level of trust. Let TTP be a Trusted Third Party. Let denote by N c the set of certified nodes, that is the nodes whose identity is assured and monitored by TTP. Given a node u ∈ N we denote by Γ(u) the set of neighbors of u (i.e., adjacent nodes). Moreover, we denote by R(u) ⊆ Γ(u) the set of nodes recognized by u.

Definition III.1. We say that a node u ∈ N is t-recognized (in A ⊆ N ) if either: (i) u ∈ N c (i.e., is a certified node), or (ii) there exist t other t-recognized nodes in A that recognize u.

When the set A of the definition above is not specified, we intend that a node is t-recognized in N . From the above definition it immediately follows that nodes in N c are trecognized for any t and in any set A. We define now the notion of t-closed set.

Definition III.2. A set A ⊆ N of t-recognized nodes in A is said t-closed, if there is no u ∈ N \ A that is t-recognized in A too.
From the above definition it immediately follows that all certified nodes must belong to any t-closed set.

Theorem III.1. For any t-closed set A, it holds that N c ⊆ A.

With the next theorem we state that the operator induces a partial order over the set of t-closed sets, which is a lower semi-lattice. First, we define this set.

Definition III.3. We denote by N t ⊆ 2 N the set of non-empty t-closed subsets of N . Now, we are ready to state the following theorem.

Theorem III.2. N t is a lower semi-lattice.

Let denote by N t b the bottom of the semi-lattice N t . In our model, the role of N t b is central, because it includes exactly all nodes that are t-recognized, but, due to subset minimality, they do not form clusters whose recognizing is only mutual. In other words, N t b is the set of nodes for which trust paths start from certified nodes. For this reason, we use N t b to trust nodes.

Definition III.4. Given a node u ∈ N we say that u is t- trusted (in N ) if u ∈ N t b . N t b is also said the set of t-trusted nodes (in N ).
To formalize the relationship of t-trustworthiness of a node with the presence of certified nodes supporting the trust, we introduce the notion of support and kernel of a t-trusted node in N t b . Definition III.5. A support for a node u ∈ N t b \ N c is any subset S t u ⊆ N c such that u is t-trusted also in the transformation of G obtained by restricting the set of certified nodes to S t u . A kernel K t u for u is any subset minimal support for u.

The next theorem states in which terms we intend the level of trust represented by t-trustworthiness. Informally, being ttrusted for a node means that there are at least t trust chains starting from certified nodes.

Theorem III.3. Given a node u ∈ N t b \ N c , any kernel K t u for u is such that |K t u | ≥ t.
The above definition of N t b and, consequently, of ttrustworthiness of a node, is declarative, so it does not give us any information about how to compute if a node is t-trusted or not. Thus, we provide an operational definition of N t b , based on the fixpoint of a monotone operator Λ t , called t-recognizing operator. This definition also gives us a more intuitive support about the property stated earlier, for which the trust of nodes in N t b can be directly or indirectly linked to (at least) t certified nodes.

Definition III.6. We define the t-recognizing operator Λ t :

2 N → 2 N as follows: (i) Λ t (∅) = N c (ii) Λ t (A) = {u ∈ N | ∃B ⊆ A s. t. |B| ≥ t ∧ u ∈ v∈B R(v)}.
Now, we define the following sequence of sets:

Λ 0 t = Λ t (∅); Λ k t = Λ t (Λ k-1 t
), for any k > 0. By proving first that the operator is monotone, we can obtain the following results:

Theorem III.4. The operator Λ t has a fixpoint, i.e., there exists k > 0 such that

Λ k t = Λ k-1 t
. We denote this fixpoint as

Λ ∞ t .
The next theorem states the equivalence between the declarative definition above and the operational one.

Theorem III.5. The set of t-trusted nodes N t b coincides with the fixpoint of the t-consequence operator Λ ∞ t . The above theorem provides a direct way to compute the set of t-trusted nodes N t b , and thus to establish if a node is t-trusted or not. Algorithm 1 summarizes this computation strategy.

The above notion of t-trustworthiness embeds a lossless propagation of trust, in which the level of assurance of identity based on recognition of users, does not degrade if the t redundancy property holds at every step of propagation. In other words, the t-redundancy property is considered as a threshold to propagate the trust. The t-redundancy parameter implicitly represents the assumption that the multiple identification of a node u done by nodes in turn identified with the same trust level, and so on, until t certified nodes are reached, can be considered sufficient to trust the identity of u. The approach applies the concept of trust chain used in the context of digital certification to the domain of identity management in social networks, with the aim of contrasting the problem of fake identities. It add n i to N t b ;

but only a trust level directly connected with the value t. The higher t, the higher the trust about identities.

So far, the trust model assumes that, once a user has recognized another user, no revision of this information must be done. This assumption would be valid only in absence of attacks able to give the attacker the access to the user profile (even temporarily). So we assume a sort of safe state with regards to fraudulent accesses. In other words, the trust model above prevents from the risk of fake profiles and fake identities but not from fraudulent access to legitimate profiles.

To contrast this further case, we introduce a biometricbased reinforcement to combine with the above trust-chain mechanism, in order to decrease the trust on a given subject if the biometric trait is not recognizable and thus managing also non-safe states. Indeed, the full trust in our mechanism is obtained by relying on the assumption that the disclosure of trusted real-life identities prevents from misbehavior of users in the trust mechanism itself, under the t-redundancy assumption.

But, if the operating user is not the legitimate one, the above assumption fails, so the identity of those users whose trust is based on paths involving the potentially attacked profile should be not fully trusted. In other words, to take into account this aspect, we have to enable a gradual level of trust, from 0 to 1 (while before the trust was basically either 0 or 1), and use an -approximation approach to trust identities. The first step is to modify the notion of t-recognized. Obviously, we keep the redundancy parameter t in the new definition, but we introduce the possibility that a user is not fully identified in a given moment, due to the fact that the biometric support is giving a warning rate. We require that nodes in N c (i.e., certified nodes) loose their state if the biometric support gives a warning rate. Thus, we can assume that certified nodes are not attacked. Given a node u, we define the set R (u) (where 0 ≤ ≤ 1) as the set of pairs v, b r (v) such that v ∈ R(u) (i.e., v is a node recognized by u in the safe state) and 1 -≤ b r (v) ≤ 1 is the current biometric rate (i.e., the score computed as in Section III-B normalized from 0 to 1), provided that it is higher than a given threshold 0 < 1-≤ 1 under which v must be currently considered not recognized. Obviously, for = 0 we fall in the safe state. We say that nodes in R (u) are -recognized by u. At this point, we are ready to extend the notion of t-recognized to a non-safe state.

Definition III.7. We say that a node u ∈ N is t, , rrecognized (in N ) if either: (1) u ∈ N c (i.e., is a certified node), or (2) there exists a set B of t, , r -recognized nodes such that both

(i) u / ∈ B, (ii) |B| ≥ t, (iii) u ∈ R (v), for each v ∈ B, (iv) 1 -≤ r ≤ 1, and (iv) v∈R br(v) |B| ≥ r.
It is easy to see that a node is t-recognized, according to Definition III.1, if and only if it is t, 0, 1 -recognized, according to the above definition. The intended meaning of Definition III.7 is to take into account warnings triggered by the biometric support (through the parameter ), and, at the same time, to require by means of the parameter r that a possible fault of trust introduced by can be partially recovered by fortifying redundancy in order to reduce approximation. In words, if we can trust less nodes because we are not sure they are not attacked we need a larger set of witnesses to reach a safe conclusion anyway. This means that r modulates the level of assurance of trust, so that the higher r, the higher the trust on the identity of t, , r -recognized nodes. Actually, to talk about trust we have to avoid mutual self-sustained cluster of t, , r -recognized nodes, so we have to proceed as in the safe state above by requiring the minimality condition. For brevity we do not give all detail, but it is rather clear that definitions of N t b and, consequently, of t-trustworthiness of a node, can be easily extended to the non-safe case, on the basis of Definition III.7. We reach thus the definition of N t, ,r b as the bottom of the semi-lattice of subsets of t, , r -closed nodes of N . Therefore, a node is t, , r -trusted if belongs to the set N t, ,r b

. Also the definition of recognizing operator can be trivially extended so obtaining the operator Λ t, ,r in such a way that N t, ,r b coincides with the fixpoint Λ ∞ t, ,r of such operator.

IV. EXPERIMENTAL RESULTS

In this section, we conduct a preliminary experimental analysis of our approach aimed to obtain a first validation. Even though as future work we plan to contextualize our method in the related literature also experimentally, we argue this is not a crucial task in this first assessment because of the novelty (shown in the introduction and in Section II) of our approach, which, differently from the existing ones, is only based on information related to user-to-user interactions to trust the the identity of the interlocutor.

In our experiments, the parameters and their default value are: t = 15 is the level of trust, = 0.2 is the level of approximation (system parameter), r = 0.9 is the level of assurance (system parameter), N = 2.500 is the number of nodes, C = 250 is the number of certified nodes, and M = 0 is the number of attacked nodes.

Test Bed. The dataset used in this experimental campaign is a synthetic graph combined with real-life biometric data. It is well known that the degree of social-network graphs follows a power-law distribution [START_REF] Kumar | Structure and evolution of online social networks[END_REF], [START_REF] Cha | Measuring user influence in twitter: the million follower fallacy[END_REF], [START_REF] Buccafurri | Bridge analysis in a social internetworking scenario[END_REF]. This can be obtained by using the Barabási-Albert model [START_REF] Barabási | Emergence of scaling in random networks[END_REF], one of the most famous algorithms for generating random scale-free networks using preferential attachment. Starting from a single-node graph, each new node is connected to the existing nodes by following the law: the more the node degree, the more the probability to receive new links is. The parameters of the Barabási-Albert model used in our experiments are the most commonly adopted in this context. We started by randomly elect certified nodes (whose number is denoted by C) among nodes with degree higher than 0, assuming that isolated nodes do not ask to be certified. We simulate the interaction among connected nodes and used biometry to decide if an interacting node is attacked. As for the biometric component of the experiments, we used a biometric benchmark database composed of keystroke dynamics [START_REF] Idrus | Soft biometrics database: A benchmark for keystroke dynamics biometric systems[END_REF]. It is composed of biometric template from 110 individuals typing on two desktop keyboards (French keyboard for users in France and Norwegian keyboard for users in Norway) i.e. AZERTY and QWERTY (this is not a classical QWERTY keyboard, however, we do not use specific Norwegian keys), respectively.

Giot et al. tested the influence of keyboards on the performances, and noticed no significant differences between a laptop and a USB keyboard [START_REF] Giot | Unconstrained keystroke dynamics authentication with shared secret[END_REF].

For this dataset, we considered 14 digraphs: latency of 'ca', 'ic', 'ed', 'he', 'pe', 'te', 'ch', 'li', 'ri', 'll', 'on', 'er', 'es' and 'st'. The size of the biometric template is 14. We generated legitimate scores by comparing the reference template with templates from the same user. In our attack model, we simulated impostors by replacing the reference template of the victim user with templates coming from other users.

Results. The first experiment is devoted to the study of the performance of our approach when no attack is performed. Starting from our dataset, we varied the number of certified nodes C from 0 to 15% nodes (i.e., 375 of 2.500 nodes) and we measured the overall number of non-certified nodes that are considered trusted, say T n . We used as metric CV = Tn C , measuring the gain in the number of trusted nodes with respect to the number of certified nodes. In Figure 2, we show the values of CV for three levels of trust, t = 10, 15, and 20. From the analysis of these results, we observe that there is a threshold value of certified users, under which the low number of certified nodes makes ineffective our solution. This threshold can be quantified in about 6-7 times the level of trust t: for example, when t = 10, with about 2.5% certified nodes (i.e., about 62 certified nodes) we are able to classify about 8•62 nodes as trusted. After this threshold, trusted relationships are established and further increasing in the number of certified nodes do not any advantages. Observe that the decreasing trend of all the three curves is due to the fact that C is in the denominator of CV . Now, we study the performance of our model when attacks occur: specifically, we study the strength of trust relationships when some nodes are compromised. Starting from a trusted scenario, we computed the fraction T V of trusted nodes which are yet recognized after M nodes are attacked, with M varying from 0 to 15% nodes. The result of this experiment is shown in Figure 3. We consider two cases: in the first one (with label "random" in the figure legend), compromised nodes are selected randomly; in the second case (label "level"), compromised nodes are first selected among those distant one hop from certified nodes, then among those distant two hops from certified nodes, and so on. This case is representative of a collusion attack in which attacker close to a victim collaborate to compromise its reputation. The fact that attacked nodes are not trusted anymore is directly entailed by our mechanism, so we do not report this trivial result. Instead, we studied the resilience of the global trust graph to analyze the global impact From the analysis of this result, we observe that the system is robust, even in presence of a not negligible number of attacked nodes, as the most of the remaining trusted nodes continue to be classified as trusted. In contrast, the model performance degrades quickly if attacked nodes can be suitable selected: however, it is quite unrealistic to identify and compromise specific accounts in a large social network.

V. CONCLUSION AND PERSPECTIVES

In this paper, we proposed a collaborative approach based on user-to-user interaction and keystroke-dynamics to trust identities in a social network. The peculiarity of our method is that it only relies on the view a user has of the neighborhood combined with real-life background information and trust propagation. We tested our method on a combination of reallife and synthetic data, by obtaining promising results (a good coverage with few certified nodes and a good resilience in case of attacks). The next step of our research will be to complete the theoretical characterization of the model, to deal with some detail about user recognition, to deepen the experimental analysis, and to deal with implementation issues.

Figure 1 .Figure 1 :

 11 Figure 1: Information captured in a keystroke dynamics system when pressing C and O keys [29].

Figure 2 :

 2 Figure 2: The gain in the number of trusted nodes with regards to the number of certified nodes for a trusted scenario

Figure 3 :

 3 Figure 3: The variation of the fraction of trusted nodes against the number of attacked nodes in an untrusted scenario

  is worth remarking that the model cannot provide absolute guarantees, Algorithm 1 Implementation of Operator Λ t (Definition III.6) Variable: n 1 , . . . , n |N | , array of nodes; The set of all graph nodes Variable: t 1 , . . . , t |N | , array of integer; The set of integers representing the computed level of trust of each node

	1: procedure COMPUTE N t b
	2:
	3:	Variable: v 1 , . . . , v |N | , array of boolean;	The set of already visited nodes
	4:
	5:	Variable: found, boolean;	Used to terminate the algorithm when no change in trust values is found
	6:	for all nodes n i ∈ N do	Initialization: trust level is 1 for certified nodes, 0 otherwise
	7:	if (n i ∈ N c ) then
	8:	v i =true; t i =t;
	9:	else
	10:	v i =false; t i =0;
	11:	found=true;
	12:	while (not found) do	Iterative computation of node trust level
	13:	found=false;
	14:	for all nodes n i ∈ N do
	15:	if (not v i ) and (t i ≥ t) then
	16:	found=true;
	17:	v i =true;
	20:	for all nodes n i ∈ N do	Building N t b to be returned
	21:

18:

for all nodes n j ∈ R(n i ) do 19:

t j = t j + 1; if (t i ≥ t) then 22:


OFFLINE PERSONAL AUTHENTICATING DEVICE APPLIED IN HOSPITALS AND E-BANKING OffPAD

Motivation

The concept of Lucidman (Local User-Centric Identity Management) is an approach to providing scalable, secure and user friendly identity and authentication functionalities.

In this context we demonstrate the OffPAD as a trusted device to support different forms of authentication.

The Lucidman/OffPAD approach consists of locating the identity management and authentication functionalities on the user side instead of on the server side or in the cloud.

OffPAD aims to strengthen authentication assurance, improves usability, minimizes trust requirements, and has the advantage that trusted online interaction can be achieved even in the presence of malware infection of client platforms.

A video for this demo is available online.

Authentication Classes and Types Authentication Classes

The distinction between a system entity (client or server) and a legal/cognitive entity (human or organisation) brings into play multiple entities on each side in the client-server model.

Three authentication types

Syntactic being the simplest, including X.800 certificates, which, e.g., does not prevent phishing attacks since the relying party is indifferent to the identity of the certificate owner;

Semantic authentication includes syntactic and moreover the verification by the relying entity that the remote entity has semantic characteristics that are compliant with a specific security policy;

Cognitive being the richest, requiring the relying party to have cognitive reasoning power, such as in humans or advanced AI systems. Cognitive authentication effectively prevents phishing attacks as users recognise the server identity, spotting a malicious owner of a legitimate certificate accepted by the browser.

OffPAD device

Prototype OffPAD version 1 . Sign and check signature using the OffPAD's holder private key (unlocked after successful holder's authentication).

Show sensitive information using the e-Ink display or the multi-color LED.

Biometric user enrolment on the OffPAD according to the specified biometric modality.

ASSUMPTIONS:

• We assume that the sensors integrated in the OffPAD are secure.

• OffPAD still makes use of the host phone for other sensors, like camera, thus a malware on the phone can communicate false information to the OffPAD.

• OffPAD also asks the host phone for the heavier computations, e.g., for OCR. However, all these inputs from the phone are considered in our scenarios as untrusted.

• The OffPAD is a trusted device, i.e. assumed to function as intended and to be adequately protected against relevant attacks. OffPAD jacket is designed to withstand physical or software tempering.

• OffPAD is considered offline, meaning that communications follow controlled formats, during short and restricted time periods, not involving wireless broadband capabilities.

• Being offline eliminates exposure to Internet threats. Thus we assume that attackers are unable to exploit bugs in OffPAD's firmware and applications.

Features

Portability: OffPAD is designed as a phone cover connected to its host with a standard micro-USB interface. This makes the OffPAD a portable object, but not a second electronic object in the user's pocket.

Biometrics: Unlocking the OffPAD is currently done through fingerprint biometrics.

Usability: OffPAD is intended to increase security assurance with minimal interference with the normal tasks of the user, yet automate some of the authentication and identity management related tasks.

Anywhere security: OffPAD allows to achieve trusted online interactions even on malware infected client platforms like the Android OS. Multi-login: Automatic access to a resource conditioned on multiple users authenticated at once, also using TellU Smarttracker system. Strong auth.: Strong authentication required for accessing sensitive information or tasks, using biometric fingerprint authentication of the user by the OffPAD. Zooko's triangle for Petname Models.

Links

Bryce "Zooko" Wilcox-O'Hearn described in 2005 three fundamental desirable properties of names:

• global (like DOIs or URLs) ;

• unique (collision-free within a domain) ;

• memorable (or human-meaningful).

Zooko explains with supporting evidence why no name space can have all three properties!

The Petname Model consists of two name spaces:

• one of global and unique names (pointers) ;

• one of memorable and unique names (petnames) ; • mapping a name space of pointers to individual name spaces of petnames, which thereby combines all three desirable properties.

HTTP Extended DAA (XDAA)

HTTP Digest Access Authentication (HTTP DAA, RFC 7616) is an user authentication protocol :

1. client sends a query (HTTP GET) ; 2. server responds with a Challenge (HTTP 401) 3. client prompts for username and password ; 4. client computes the Response ; 5. client sends a new query, with the Response ;

6. server answer the query (HTTP 200).

Response = hash( HA1 ":" Challenge ":" HA2) HA1 = Hash(username ":" realm ":" password) HA2 = Hash("GET" ":" uri) Klevjer, Varmedal, & Jøsang extend HTTP DAA :

• challenge forwarded to the OffPAD ;

• password generated from user biometric ;

• HA1 can be precomputed and stored on the OffPAD.

Mutual authentication using Petnames and XDAA Sequence of messages/actions for user and server authentication ceremony:

Nr. Message / action description 1. User initiates connection with Bank's server through the client/browser (which is not trusted). 2. Server sends HTTP XDAA challenge to client, along with the Bank's ID in a certificate (maybe using DNSSEC). 3. Challenge and BankID are forwarded by browser to OffPAD. 4. OffPAD presents user authentication request to user. 5. Server certificate is forwarded to OffPAD. 6. Server certificate is validated (syntactic server authentication). 7. Server certificate/BankID is mapped to petname. 8. Petname is presented to user. 9. User performs cognitive server authentication. 10. User approves authentication request. 11. OffPAD computes response to challenge from server. 12. Response is sent from OffPAD to client. 13. Client forwards response to server. 14. Server verifies response which completes user authentication. • perform strong authentication using biometrics ;

• convey trustworthy information to user.

Decision support system provided by TellU partner:

• can communicate with OffPAD device ;

• manage location information of the OffPAD device • manage decision processes, e.g., based on location • interact with hospital system.

Hospital network includes:

• Terminals, where users (nurses, doctors, patients) can login to see specific information (like current task to be done, or access to personal TV setup) ; • hospital/health information Servers (e.g., Access Control engines).

Indoor location system provided by Sonitor partner: a

• TAGs to locate the users ;

• LF exciters to locate the fixed terminals ;

• Sonitor indoor location server.

a Can be replaced by other systems, e.g., based on wireless points.

Automatic login-logoff and Multi-login

Pairing and Take in use

• Nurse takes OffPAD in use at beginning of shift by authenticating through biometric fingerprint. • Device loads user profile and registers to TellU.

• Nurse pairs location TAG to OffPAD device.

• Pairing information sent to TellU system Now the TAG tracked by the Sonitor system is known to TellU as being attached to the User that activated the respective OffPAD.

Context based Access Control

• Indoor location of Objects (Nurse/Patient/ Doctor) tracked in real-time by the Sonitor system. • When Nurse approaches a Terminal the TellU decision system is notified and a login event is triggered through the Hospital system. • When Nurse walks away, the TellU system is notified by Sonitor, and triggers a logoff event.

• Continuous biometric authentication methods can ensure that OffPAD is in User's possession.

Multiple users Access Control

• Both Nurse and Patient are in front of a Terminal.

• TellU system triggers an access control event parametrized by the objects. • Sensitive information can now be displayed, e.g.

Patient Record can be shown only when the Patient is in the room.

Strong authentication

• Context authentication may be not good enough for some sensitive operations or information, e.g. signing a receipt, or ending a task. • Hospital system may require the Nurse to authenticate through the OffPAD using biometric fingerprint before allowing access.

  Authentication of user Data by the Service provider, based on OCR (Optical Character Recognition), alternatively displayed on the OffPAD e-Ink screen. SU: Server authentication by the User, based on petname systems managed by the OffPAD. US: User authenticated by the service provider, based on an extended challenge-response protocol XDAA (HTTP Extended DAA) between the client terminal and OffPAD. Auto-login: Contextual automatic login/off based on indoor location of the OffPAD, using Sonitor's system.

  types the transaction data in a browser window on the client computer. 2. User activates the OffPAD to take a snapshot of the browser window. 3. Snapshot is taken of the text displayed in the browser window on the untrusted client. 4. The OCR (or QR code) function recovers the transaction data from the snapshot. 5. MAC generation with the transaction data and the userpassword as input. 6. OffPAD sends MAC to client computer. 7. Client computer sends transaction data together with MAC to server. 8. Server verifies that the MAC corresponds to the received transaction data.

  (Nonce,BankID,Cert) Sequence diagram for User authentication ceremony and Cognitive authentication of Server by User. eHospital Infrastructure OffPAD to: • manage User credentials, perform security operations (certificate validation, biometric auth.) ; • automatic login by interacting with other systems ;

Acknowledgements

We thank all OffPAD project members who have either put effort into parts of this demo or have contributed with great ideas or discussions; particularly to: