Christophe Chesneau

Thomas Willer

Estimation of a cumulative distribution function under interval censoring "case 1" via warped wavelets

Keywords: Adaptive estimation, Strongly mixing, Interval censoring, Warped wavelets, Hard thresholding AMS 2000 Subject Classifications: 62G05, 62G20

The estimation of an unknown cumulative distribution function in the interval censoring "case 1" model from dependent sequences is considered. We construct a new adaptive estimator based on a warped wavelet basis and a hard thresholding rule. Under mild assumptions on the parameters of the model, considering the L 2 risk and the weighted Besov balls, we prove that the estimator attains a sharp rate of convergence. We also investigate its practical performances thanks to simulation experiments.

Introduction

The mathematical context of the interval censoring "case 1" model can be described as follows: let (δ i , U i ) i∈Z be a strictly stationary process where, for any i ∈ Z,

δ i = 1 {X i ≤U i } ,
1 A is the indicator function on any random event A, X i and U i are independent for any i, and (X i ) i∈Z is a strictly stationary process with common unknown cumulative distribution F . We assume that U 1 admits a density, denoted by g, and we denote by G its cumulative distribution function. Our goal is to estimate F under mild assumptions on g from n observations (δ 1 , U 1 ), . . . , (δ n , U n ) of (δ i , U i ) i∈Z . This model has applications in Demography and Biology. See e.g. [START_REF] Diamond | The analysis of current status data. Demographic applications of event history analysis[END_REF] and [START_REF] Jewell | Current status data: review, recent developments and open problems[END_REF], and the references therein.

For recent statistical results, we refer to [START_REF] Van Der Vaart | Estimating a survival distribution with current status data and high-dimensional covariates[END_REF], [START_REF] Brunel | Cumulative distribution function estimation under interval censoring case 1[END_REF] and [START_REF] Chagny | Nonparametric warped kernel estimators[END_REF]. In particular, considering the independent case, [START_REF] Brunel | Cumulative distribution function estimation under interval censoring case 1[END_REF] have constructed adaptive penalized minimum contrast estimators built on trigonometric, polynomial or wavelet spaces. Using the L 2 risk over Besov balls, under some boundedness assumptions on g, [2, Corollary 3.1] proves that it attains the standard rate of convergence "n -2s/(2s+1) " where s characterizes the smoothness of F .

However, the independence assumption on (δ i , U i ) i∈Z is often stringent in applications. In this study, we investigate the adaptive estimation of F in a dependent setting (including the independent one). The so-called strong mixing case is considered. Examples and applications of this kind of dependence can be found in [START_REF] Carrasco | Mixing and moment properties of various GARCH and stochastic volatility models[END_REF] and [START_REF] Doukhan | Mixing. Properties and Examples[END_REF].

Assuming that g is known but with no boundedness assumptions on it, we develop a new adaptive estimator based on a warped wavelet basis and a hard thresholding rule. The features of this basis consist of a standard wavelet basis and of the definition of G related to the model. This enables us to give a significant stability to our thresholding algorithm. Such a technique has been already used with success in the framework of nonparametric regression with random design by [START_REF] Kerkyacharian | Regression in random design and warped wavelets[END_REF]. Recent works on warped wavelet basis in nonparametric statistics can be found in [START_REF] Chesneau | A maxiset approach of a Gaussian noise model[END_REF], [START_REF] Chesneau | Numerical performances of a warped wavelet estimation procedure for regression in random design[END_REF], [START_REF] Brutti | Warped wavelets and vertical thresholding[END_REF], [START_REF] Pham Ngoc | Regression in random design and Bayesian warped wavelets estimators[END_REF], [START_REF] Chagny | Penalization versus Goldenshluger-Lepski strategies in warped bases regression[END_REF] and [START_REF] Chagny | Warped bases for conditional density estimation[END_REF].

Considering the L 2 risk over weighted Besov balls, we prove that our estimator attains the rate of convergence "(ln n/n) 2s/(2s+1) ", where s characterizes the smoothness of F . This rate of convergence corresponds to the one attained in the i.i.d. case (see [START_REF] Brunel | Cumulative distribution function estimation under interval censoring case 1[END_REF]) up to an extra logarithmic term. Finally, we explore the numerical performances of the estimator.

The rest of the paper is organized as follows. Section 2 introduces notations and assumptions on the model. In Section 3, we describe warped wavelet bases on [0, 1] and weighted Besov balls. Our adaptive wavelet estimator is defined in Section 4. Theoretical and practical results are presented in Section 5. The proofs are postponed to Section 6.

Notations and assumptions 2.1 Assumptions on the dependence structure of the process

For any m ∈ Z, we define the m-th strongly mixing coefficient of (X i , U i ) i∈Z by a m = sup

(A,B)∈F (X,U ) -∞,0 ×F (X,U ) m,∞ |P(A ∩ B) -P(A) P(B)| , (2.1)
where

F (X,U )
-∞,0 is the σ-algebra generated by the pairs of random variables . . . , (X -1 , U -1 ), (X 0 , U 0 ) and F (X,U ) m,∞ is the σ-algebra generated by the random variables (X m , U m ), (X m+1 , U m+1 ), . . . We consider the exponentially strongly mixing case: there exist two constants γ > 0 and c > 0 such that, for any integer m ≥ 1,

a m ≤ γ exp(-cm).
(

This assumption is not very restrictive; some examples of processes satisfying such conditions can be found in e.g. [START_REF] Withers | Conditions for linear processes to be strong-mixing[END_REF], [START_REF] Doukhan | Mixing. Properties and Examples[END_REF], [START_REF] Modha | Minimum complexity regression estimation with weakly dependent observations[END_REF] and [START_REF] Carrasco | Mixing and moment properties of various GARCH and stochastic volatility models[END_REF].

Assumptions on the densities

For the sake of simplicity, we suppose that all the considered random variables take their values in [0, 1].

In the main part of the study, we assume that g is known. The unknown case will only be explored in the simulation study in subsection 6.2.

We suppose that, for any interval [a, b] ⊆ [0, 1], there exists a constant C > 0 such that

1 b -a b a g(x) 2 dx 1/2 ≤ C 1 b -a b a g(x)dx. (2.3)
This "reverse Hölder inequality" is related to the Muckenhoupt weights theory. It includes a wide variety of densities, non-necessarily bounded from above and/or below. For instance, g(x) = (u + 1)x u , x ∈ [0, 1] and u ∈ (0, 1) satisfies (2.3). Further details can be found in [20, subsection 4.1].

For any m ∈ {1, . . . , n}, let f (X 0 ,U 0 ,Xm,Um) be the density of (X 0 , U 0 , X m , U m ), f (X 0 ,U 0 ) the density of (X 0 , U 0 ) and, for any (y, x, y

* , x * ) ∈ [0, 1] 4 , h m (y, x, y * , x * ) = f (X 0 ,U 0 ,Xm,Um) (y, x, y * , x * ) -f (X 0 ,U 0 ) (y, x)f (X 0 ,U 0 ) (y * , x * ).
(2.4)

We suppose that there exists a constant C > 0 such that sup m∈{1,...,n} sup

(x,x * )∈[0,1] 2 1 g(x)g(x * ) x 0 x * 0 |h m (y, x, y * , x * )|dydy * ≤ C.
(2.5)

Note that, in the independent case, we have h m (y, x, y * , x * ) = 0 and (2.5) is satisfied. Moreover, functions g satisfying (2.3) and (2.5) are not necessarily bounded from below and above. Hence our conditions are less restrictive than [2, Assumption A1].

Warped wavelets and weighted Besov balls

Let N be a positive integer. We consider an orthonormal wavelet basis generated by dilations and translations of a "father" Daubechies-type wavelet φ and a "mother" Daubechies-type wavelet ψ of the family db2N (see [START_REF] Daubechies | Ten lectures on wavelets[END_REF]). In particular, mention that φ and ψ have compact supports. We set

φ j,k (x) = 2 j/2 φ(2 j x -k), ψ j,k (x) = 2 j/2 ψ(2 j x -k).
Suppose that (2.3) holds and recall that

G(x) = P(U 1 ≤ x) = x 0 g(u)du, x ∈ R.
Then, with an appropriate treatment at the boundaries, there exists an integer τ satisfying 2 τ ≥ 2N such that, for any integer

j * ≥ τ , any h ∈ L 2 ([0, 1]) = h : [0, 1] → R; 1 0 h 2 (x)dx < ∞ can be expanded into a warped wavelet series as h(x) = 2 j * -1 k=0 α j * ,k φ j * ,k (G(x)) + ∞ j=j * 2 j -1 k=0 β j,k ψ j,k (G(x)), x ∈ [0, 1],
where

α j,k = 1 0 h(G -1 (x))φ j,k (x)dx, β j,k = 1 0 h(G -1 (x))ψ j,k (x)dx. ( 3.1)
See [20, subsection 3.3]. Let M > 0 and s > 0. We say that a function h in L 2 ([0, 1]) belongs to the weighted Besov ball B w s,∞ (M ) if there exists a constant M > 0 such that the associated wavelet coefficients (3.1) satisfy, for any integer j ≥ τ ,

2 j -1 k=0 β 2 j,k w j,k ≤ M 2 -j(2s+1) ,
where

w j,k = (k+1)/2 j k/2 j 1 g(G -1 (x)) dx. (3.2)
In this expression, s is a smoothness parameter. Details concerning the warped wavelets and the analytic definition of weighted Besov balls can be found in [20, Section 7]. For the standard wavelet basis on [0, 1], see e.g. [START_REF] Meyer | Wavelets and Operators[END_REF] and [START_REF] Cohen | Wavelets on the interval and fast wavelet transforms[END_REF].

Estimators

For any integer j ≥ τ and any k ∈ {0, . . . , 2 j -1}, we estimate the unknown warped wavelet coefficients of F i.e. α j,k =

1 0 F (G -1 (x))φ j,k (x)dx and β j,k = 1 0 F (G -1 (x))ψ j,k (x)dx by respectively αj,k = 1 n n i=1 δ i φ j,k (G(U i )), βj,k = 1 n n i=1 δ i ψ j,k (G(U i )). (4.1)
Some of their statistical properties are investigated in Propositions 6.1, 6.2 and 6.3 below.

We estimate F by the following hard thresholding estimator F :

F (x) = 2 j 0 -1 k=0 αj 0 ,k φ j 0 ,k (G(x)) + j 1 j=j 0 2 j -1 k=0 βj,k 1 {| βj,k |≥κρn} ψ j,k (G(x)), (4.2)
where x ∈ [0, 1], j 0 is an integer such that 1 2 ln n < 2 j 0 ≤ ln n, αj 0 ,k and βj,k are defined by (4.1), j 1 is the integer satisfying

1 2 n (ln n) 3 < 2 j 1 ≤ n (ln n) 3 , (4.3)
κ is a large enough constant (the one in Proposition 6.3 below) and ρ n denotes the "universal threshold", i.e.

ρ n = ln n n . (4.4)
Naturally, for x < 0, we put F (x) = 0 and, for x > 1, F (x) = 1. Note that F is adaptive: its construction does not depend on the smoothness of F . The general idea in the construction of F is to apply a term-by-term selection on the unknown wavelet coefficients of F : only the most significant are kept. The reason is that only these few coefficients contain the main characteristics of F . For the construction of hard thresholding wavelet estimators in the standard nonparametric models, see e.g. [START_REF] Donoho | Density estimation by wavelet thresholding[END_REF], [START_REF] Delyon | On minimax wavelet estimators[END_REF] and [START_REF] Härdle | Wavelet, Approximation and Statistical Applications[END_REF].

When g is unknown, an intuitive adaptive estimator of F is (4.2) but, instead of G, we consider its empirical version:

Ĝn (x) = 1 n n i=1 1 {U i ≤x} .
This plug-in method yields the hard thresholding estimator

F * (x) = 2 j 0 -1 k=0 α * j 0 ,k φ j 0 ,k ( Ĝn (x)) + j 1 j=j 0 2 j -1 k=0 β * j,k 1 {| βj,k |≥κρn} ψ j,k ( Ĝn (x)), (4.5)
x ∈ [0, 1], where

α * j,k = 1 n n i=1 δ i φ j,k ( Ĝn (U i )), β * j,k = 1 n n i=1 δ i ψ j,k ( Ĝn (U i )).
We do not investigate the theoretical performances of this estimator, but we use it throughout the simulation and real data study of Section 5.2.

5 Performances of F

Theoretical results

Theorem 5.1 Suppose that the assumptions of Section 2 hold. Let F be (4.2). Suppose that F ∈ B w s,∞ (M ) with s > 0. Then there exists a constant C > 0 such that

E 1 0 F (x) -F (x) 2 dx ≤ C ln n n 2s/(2s+1)
.

The proof of Theorem 5.1 uses a suitable decomposition of the L 2 risk including some geometrical properties of the warped wavelet basis and the statistical properties of the wavelet coefficients estimators presented in Propositions 6.1, 6.2 and 6.3. Theorem 5.1 shows that, under mild assumptions on the dependence of the observations and on g, F attains a rate of convergence close to the one for the i.i.d. case i.e. n -2s/(2s+1) . The difference is the "negligible" logarithmic term (ln n) 2s/(2s+1) .

Let us recall that, if we restrict our study to the independent case, contrary to [2, Assumption A1], Theorem 5.1 holds without boundedness assumptions on g.

Practical results

This section is devoted to the numerical performances of F . We restrict ourselves to the i.i.d. case: no exponentially strongly mixing hypothesis is made here.

Preliminary remarks on the estimators

In practice, the construction and the performances of the two estimators in the case of known or unknown design density are very close. Thus for the sake of brevity, we present only the results for the unknown design density procedure.

We compare the performances of the warped wavelet estimator to those of the piecewise polynomial regression estimator developped in [START_REF] Brunel | Cumulative distribution function estimation under interval censoring case 1[END_REF]. Another procedure, named quotient estimator, is also proposed in that paper. However it is generally outperformed by the regression estimator, so we focus only on the warped wavelet and the piecewise polynomial estimators. We name them respectively WWE and PPE in the sequel. We give examples of their behaviours when applied to various simulated data sets and to one real data set.

In both methods, one needs to fit several preliminary parameters. For the WWE, the calibration of the threshold κρ n and of the cutoff level j 1 are important practical issues. The values given by the theory are not useful in practice. Indeed the thresholds are defined up to some intricate "large enough constant κ". Moreover the cutoff level j 1 defined in (4.3) is too small in practice, as it is even lower than the minimal coarsest level value. Thus, for j 1 , we use j 1 = log 2 (n) -1, i.e. the maximal possible level, hoping the high resolution "noise" is filtered thanks to thresholding.

For the thresholds, we can use an analogy with the non-parametric regression model in random design. Indeed the censoring model amounts to observing at each design point U i some Bernoulli variable δ i with (conditionally to U i ) expectation F (U i ) and standard deviation

F (U i )(1 -F (U i )).
In the usual regression model one observes at each design point U i some Gaussian variable δ i with (conditionally to U i ) expectation F (U i ) and some given standard error σ. Thus we calibrate κ as in regression (see [START_REF] Chesneau | Numerical performances of a warped wavelet estimation procedure for regression in random design[END_REF]) as the following random value:

κ r = 1 n -2 n i=2 (δ (i) -δ (i-1) ) 2 ,
where each δ (i) refers to the value δ k such that U k is the i-th higher coordinate of the vector (U j ) 1≤j≤n . Nevertheless, the standard error is highly heteroscedastic in the censoring problem: it varies from 0 for observations near the edges of the observation interval, to 0.5 near the median of F . Thus we also use a more conservative deterministic threshold corresponding to

κ d = 0.5 × √ 2 = 1 √ 2 .
Thus, we make sure that the high noise of the median observations is well taken into account in the thresholds. In the sequel, we name the random threshold estimator WWEr and the deterministic threshold estimator WWEd.

Lastly, we use the 'Daubechies 4' wavelet basis for the simulated data study, and the 'Daubechies 3' wavelet basis for the real data study (as the number of observations is a bit small for Daubechies 4 basis).

The PPE also requires to fix some preliminary parameters. First some maximal degree of the polynomials and some maximal numbers of intervals must be put as arguments. We choose the degree as equal to 6 and maximum number of intervals as equal to 64 for the simulated data, and to 32 for the real data. Secondly some noise variance level must be put as an argument as well. We make two choices corresponding to the random and deterministic values used for WWEr and WWEd. Likewise, in the sequel, we name the corresponding estimators PPEr and PPEd.

Hence for each data set we compare the performances of four estimators: WWEr, WWEd, PPEr and PPEd.

Concerning the programs, the WWE is very simple to implement in practice. The program consists mainly in simple wavelet decompositions or recompositions, computations of thresholds, and shrinkage of some small wavelets coefficients. The PPE was implemented thanks to the FY3P.m Matlab file and several other sub-programs (all available on Yves Rozenholc's web page). The implementation is much more complex, as can be seen from the programs. What is more, the processing times necessary to compute the estimators are very different. For example one needs a CPU time of 0.078 to compute the eight Warped Wavelets Estimators represented in Figure 5.2.2, whereas one needs a CPU time of 670.49 to compute the eight Piecewise Polynomial Estimators built on the same data and represented in the same figure.

Study with simulated data

Simulation of the data

We consider four target functions F which correspond to the following formula with values q = 0.2, 1, 5, 50:

F q (t) = 2 q-1 t q , t ∈ [0, 0.5], 1 -2 q-1 (1 -t) q , t ∈ [0.5, 1]. (5.1)
These four functions are plotted in Figure 1. Furthermore we consider five different densities of the U i s. We name them Bump1, Bump2, Pit1, Pit2 and Uniform. They correspond to the following formulas (up to normalization constants), and are plotted in Figure 2.

• Bump1 g(x) = exp(-(100 * (x -0.5) 2 )) + 1, • Pit1 g(x) = -exp(-(100 * (x -0.5) 2 )) + 1.05, • Bump2 g(x) = exp(-(100 * x 2 )) + exp(-(100 * (x -1) 2 )) + 1, • Pit2 g(x) = -exp(-(100 * x 2 )) -exp(-(100 * (x -1) 2 )) + 1.05, • Uniform g(x) = 1.
The non uniform densities correspond to a surplus or a lack of design points near the edges or near the middle of the interval. The WWE should normally capture detail coefficients in zones of dense design, and fail to do so in low design density zones. Nevertheless, this design effect can be counterbalanced by the variations of the level of noise in the observation, as mentioned previously. Thus it is difficult to predict the performances of the estimator, especially in the middle of the interval. As an example, the wavelet detail coefficients of the targets are plotted in Figure 3. One can remark that F q has high detail coefficients near the edges of the interval [0, 1] when q is small, and at the middle of the interval [0, 1] when q is large. One can expect estimation problems for example for the F 5 or F 50 functions in the case of the 'Pit1' design density. An example of data and wavelet estimator An example of the data on which the estimators are based is given in Figures 4 and5 (for the cdf F 50 and for a uniform distribution of the U i s). Figure 4 represents the couples (U i , δ i ). The second row of Figure 5 gives the detail wavelet coefficients of the sequence (δ σ U (i) ) i∈{1,...,n} , where σ U is the following permutation: σ U (i) is the index j such that U j is the i st largest element of the sequence U . These coefficients are approximations of the ones given in equation (4.1), as their construction consists in replacing G by the empirical pdf Ĝn in their expressions. They should be estimations of the coefficients of the target function, which are plotted in the first row of Figure 5. Then the estimation consists in trying to select the coefficients corresponding to the signal F , and to put to zero those corresponding to the "noise".

As one can see from Figure 5, the thresholding is a hard task as the coefficients of the data are significantly different from the target coefficients. This may stem from the high noise of the observations in the middle of the interval, as discussed previously. The deterministic threshold is conservative as all the detail coefficients are thresholded. The random threshold is too low and leaves high resolution noise unfiltered. The corresponding estimators can be seen in Figure 6, and WWEr indeed contains artefacts in the middle of the interval.

Some examples of results

We give examples of realizations of the 4 estimators for all the 20 simulated data sets. Figures 6,[START_REF] Chagny | Nonparametric warped kernel estimators[END_REF][START_REF] Chesneau | A maxiset approach of a Gaussian noise model[END_REF][START_REF] Chesneau | Numerical performances of a warped wavelet estimation procedure for regression in random design[END_REF][START_REF] Cohen | Wavelets on the interval and fast wavelet transforms[END_REF] give examples for respectively the Uniform, Bump1, Pit1, Bump2, and Pit2 design densities. Each figure represents the target function (dashed line) and the estimator (solid line). We can draw the following conclusions.

• All the estimators behave rather properly at the edges of the interval, while there are sometimes problems in the middle of the interval. This is coherent with the variations of the noise variance, as discussed previously. As one could expect, the random threshold estimators have poor performances in the middle of the interval for the Uniform and Pit1 designs.

• Generally, the deterministic threshold estimators are better than the random threshold estimators. Probably the latter underestimate the noise level in the middle of the interval, and thus their performances are poor, especially when the number of observations in this zone is small.

• For the F 0.2 or F 1 targets, all the estimators are generally rather close. One can remark however that PPE is a bit better than WWE. One can check that they consist of rough approximation methods: for WWE all the detail coefficients are cut, and for PPE low degree polynomials and few intervals are selected. For WWE, one may ask oneself if the results could be improved by using other calibrations of κ and j 1 . For this purpose, one can compute some "oracle" estimator in the sense that it uses the threshold and the cutoff values which minimize the mean square error among all estimators of the type of Section 4, except with κ and j 1 left free. Of course this estimator is completely inaccessible in practice. Monte Carlo approximations of the mean square error show that the oracle strategy consists in putting all the detail coefficients to zero. Thus these two functions probably lead to globally noisy observations, and it must be hopeless to try to recover details of the targets in these cases.

• For the F 5 target, WWE generally outperforms PPE. However, for the F 50 target, PPE generally outperforms WWE.

Study with real data

We use a data set concerning a tumorigenicity experiment conducted by the National Toxicology Program (NTP) which is described and summarized in [START_REF] Dunson | Bayesian models for multivariate current status data with informative censoring[END_REF]. There are four sets of data. We use only the one corresponding to the 'control' group and the presence of adrenal tumor. The subjects were fifty rats or mice. The X i s are unobserved dates of occurrence of an adrenal tumor and the U i are dates of death. Every month during 25 months, all the dead mice or rats were examined to check if they had a tumor or not, which corresponds to respectively δ i = 1 and δ i = 0. The experience stopped after the 25th month (we consider this date as the 26th month) when all the remaining were killed and examined.

Several remarks need to be made on this data set. First at month 26 the data show that 5 out of the 13 remaining mice had no tumor, thus the upper bound of the support of F was not reached. This is why in the sequel, our estimators stop at about 0.7 and not 1. Secondly, the design dates cannot be considered as realizations of continuous random variables. In particular, since the observations are gathered by months, several deaths occurred at exactly the same time. Thus we considered that all the deaths at month m were in fact distributed on a regular grid between months m -1 and m.

The four estimators are plotted in Figure 11. The two thresholding techniques yield to the same estimator. The PPE yields a rough one degree polynomial estimation, whereas the WWE yields a more detailed curve.

Conclusion and discussion

In this paper we develop a new adaptive estimator for the cumulative distribution function under interval censoring "case 1" for possible dependent data. It is constructed from warped wavelet basis and a hard thresholding rule. Theoretical results show the good performance of our estimator under mild assumptions on the model (including vanishing density g). The practical performances were investigated thanks to a comparison with the estimator developped in [START_REF] Brunel | Cumulative distribution function estimation under interval censoring case 1[END_REF]. The wavelet estimator displays generally satisfying performances, provided a conservative calibration of the threshold is made. Moreover it is simpler and faster to compute than the estimator of [START_REF] Brunel | Cumulative distribution function estimation under interval censoring case 1[END_REF]. Possible perspectives of this work are to

• determine the rate of convergence of F * (4.5) under the L 2 risk over Besov balls,

• relax assumptions (2.2) and/or (2.5),

• improve the obtained rate of convergence by considering more sophisticated thresholding rules as those developed in [START_REF] Autin | Maxisets for mu-thresholding rules[END_REF].

Proofs

In this section, we suppose that the assumptions of Section 2 hold. Moreover, C denotes any constant that does not depend on j, k and n. Its value may change from one term to another and may depend on φ or ψ.

6.1 Auxiliary results on (4.1) Proposition 6.1 Suppose that the assumptions of Section 2 hold. For any integer j ≥ j 0 such that 2 j ≤ n and any k ∈ {0, . . . , 2 j -1}, let α j,k = 1 0 F (G -1 (x))φ j,k (x)dx and αj,k be defined as in (4.1). Then αj,k is an unbiased estimator for α j,k and there exists a constant C > 0 such that

Var(α j,k ) ≤ C 1 n ,
Let us mention that Proposition 6.1 can be proved with βj,k (4.1) instead of α j,k and

β j,k = 1 0 F (G -1 (x))ψ j,k (x)dx instead of α j,k .
Proof of Proposition 6.1. We have

E(α j,k ) = E(δ 1 φ j,k (G(U 1 ))) = E 1 {X i ≤U i } φ j,k (G(U 1 )) = 1 0 u 0 f (x)φ j,k (G(u))g(u)dxdu = 1 0 F (u)φ j,k (G(u))g(u)du = 1 0 F (G -1 (u))φ j,k (u)du = α j,k .

An elementary covariance inequality yields

Var (α j,k ) = 1 n 2 n v=1 n ℓ=1 Cov (δ v φ j,k (G(U v )), δ ℓ φ j,k (G(U ℓ ))) ≤ S + T, (6.1)
where

S = 1 n Var (δ 1 φ j,k (G(U 1 )))
and

T = 2 n 2 n v=2 v-1 ℓ=1 Cov (δ v φ j,k (G(U v )), δ ℓ φ j,k (G(U ℓ ))) .
Since δ 1 ≤ 1, we have

S ≤ 1 n E (δ 1 φ j,k (G(U 1 ))) 2 ≤ 1 n E (φ j,k (G(U 1 ))) 2 = 1 n 1 0 (φ j,k (G(x))) 2 g(x)dx = 1 n 1 0 (φ j,k (x)) 2 dx = 1 n . (6.2)
It follows from the stationarity of (δ i , U i ) i∈Z and 2 j ≤ n that

T = 2 n 2 n m=1 (n -m) Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m ))) ≤ 2 n n m=1 |Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m )))| = T 1 + T 2 , (6.3)
where

T 1 = 2 n 2 j -1 m=1 |Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m )))|
and

T 2 = 2 n n m=2 j |Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m )))| .
Upper bound for T 1 . Using (2.4), (2.5) and the change of variables y = 2 j x -k, we obtain

|Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m )))| = 1 0 1 0 1 0 1 0 h m (y, x, y * , x * ) 1 {y≤x} φ j,k (G(x))1 {y * ≤x * } φ j,k (G(x * )) dydxdy * dx * ≤ 1 0 x * 0 1 0 x 0 |h m (y, x, y * , x * )| |φ j,k (G(x))φ j,k (G(x * ))| dydxdy * dx * ≤ C 1 0 |φ j,k (G(x))|g(x)dx 2 ≤ C 1 0 |φ j,k (x)|dx 2 ≤ C2 -j .
Therefore

T 1 ≤ C 1 n 2 -j 2 j = C 1 n . (6.4)
Upper bound for T 2 . Applying the Davydov inequality for strongly mixing processes (see [START_REF] Davydov | The invariance principle for stationary processes[END_REF]), for any q ∈ (0, 1), we have

|Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m )))| ≤ Ca q m E |δ 0 φ j,k (G(U 0 ))| 2/(1-q) 1-q ≤ Ca q m E |φ j,k (G(U 0 ))| 2/(1-q) 1-q ≤ Ca q m sup x∈[0,1] |φ j,k (G(x))| 2q E (φ j,k (G(U 0 ))) 2 1-q .
We have sup x∈[0,1] |φ j,k (x)| ≤ C2 j/2 and, by (6.2),

E (φ j,k (G(U 0 ))) 2 ≤ 1. Therefore |Cov (δ 0 φ j,k (G(U 0 )), δ m φ j,k (G(U m )))| ≤ C2 qj a q m .
Hence

T 2 ≤ C 1 n 2 qj n m=2 j a q m ≤ C 1 n n m=2 j m q a q m ≤ C 1 n . (6.5)
It follows from (6.3), (6.4) and (6.5) that

T ≤ C 1 n . (6.6)
Combining (6.1), (6.2) and (6.6), we obtain

Var ( αj,k ) ≤ C 1 n .
The proof of Proposition 6.1 is complete.

Proposition 6.2 Suppose that the assumptions of Section 2 hold. For any integer j ≥ j 0 such that 2 j ≤ n and any k ∈ {0, . . . , 2 j -1}, let β j,k = 1 0 F (G -1 (x))ψ j,k (x)dx and βj,k be defined as in (4.1). Then there exists a constant C > 0 such that

E βj,k -β j,k 4 ≤ C2 j 1 n .
Proof of Proposition 6.2. Observe that

| βj,k -β j,k | ≤ | βj,k | + |β j,k | ≤ sup (x,y)∈[0,1] 2 |yψ j,k (G(x))| + C ≤ sup x∈[0,1] |ψ j,k (x)| + C ≤ C2 j/2 . (6.7)
Using (6.7) and Proposition 6.1, we obtain

E βj,k -β j,k 4 ≤ C2 j E βj,k -β j,k 2 ≤ C2 j 1 n .
The proof of Proposition 6.2 is complete.

Proposition 6.3 Suppose that the assumptions of Section 2 hold. For any j ∈ {j 0 , . . . , j 1 } and any k ∈ {0, . . . , 2 j -1}, let β j,k = 1 0 F (G -1 (x))ψ j,k (x)dx, βj,k be (4.1) and ρ n be defined as in (4.4). Then there exist two constants, κ > 0 and C > 0, such that

P | βj,k -β j,k | ≥ κρ n /2 ≤ C 1 n 4 .
Proof of Proposition 6.3. We shall use the Bernstein inequality for exponentially strongly mixing process presented in Lemma 6.1 below. The proof can be found in [START_REF] Liebscher | Estimation of the density and the regression function under mixing conditions[END_REF]. Lemma 6.1 ( [START_REF] Liebscher | Estimation of the density and the regression function under mixing conditions[END_REF]) Let γ > 0, c > 0 and (Z i ) i∈Z be a strictly stationary process defined on a probability space (Ω, A, P) with the m-th strongly mixing coefficient (2.1). Let n be a positive integer, h : R → R be a measurable function and, for any i ∈ Z, V i = h(Z i ). We assume that E(V 1 ) = 0 and there exists a constant M > 0 satisfying |V 1 | ≤ M . Then, for any m ∈ {1, . . . , n} and any λ > 0, we have

P 1 n n i=1 V i ≥ λ ≤ 4 exp - λ 2 n 16(D m /m + λM m/3) + 32 M λ na m ,
where D m = max l∈{1,...,2m} Var l i=1 V i .

For any i ∈ {1, . . . , n}, set

V i = δ i ψ j,k (G(U i )) -β j,k . Then P | βj,k -β j,k | ≥ κρ n /2 = P 1 n n i=1 V i ≥ κρ n /2 , (6.8)
V 1 , . . . , V n are identically distributed, depend on the strictly stationary strongly mixing process (δ i , U i ) i∈Z satisfying (2.2), Propositions 6.1 and 6.2 give

E (V 1 ) = 0, E V 2 1 ≤ E (δ 1 φ j,k (G(U 1 ))) 2 ≤ 1,
and, using similar arguments to (6.7),

|V 1 | ≤ C2 j/2 ≤ C2 j 1 /2 ≤ C(n/(ln n) 3 ) 1/2 . Now set m = [u
(l + l 2 2 -j 0 ) ≤ C m + m 2 ln n ≤ Cm.
It follows from Lemma 6.1 applied with these

V 1 , . . . , V n , λ = κCρ n , ρ n = (ln n/n) 1/2 , m = u ln n with u > 0 (chosen later), M = C(n/(ln n) 3 ) 1/2 and (2.2) that P | βj,k -β j,k | ≥ κρ n /2 ≤ C exp -C κ 2 ρ 2 n n 1 + κρ n mM + n 1/2 ρ n (ln n) 3/2 n exp(-cm) ≤ C exp -C κ 2 ln n 1 + κ(ln n/n) 1/2 u ln n(n/(ln n) 3 ) 1/2 + n 2 exp(-cu ln n) ≤ C n -Cκ 2 /(1+κu) + n 2-cu .
Taking κ and u large enough, we obtain

P | βj,k -β j,k | ≥ κρ n /2 ≤ C 1 n 4 .
This ends the proof of Proposition 6.3.

Proof of Theorem 5.1

Proof of Theorem 5.1. Since F ∈ L 2 ([0, 1]), we can write

F (x) = 2 j 0 -1 k=0 α j 0 ,k φ j 0 ,k (G(x)) + ∞ j=j 0 2 j -1 k=0 β j,k ψ j,k (G(x)), x ∈ [0, 1],
where

α j 0 ,k = 1 0 F (G -1 (x))φ j 0 ,k (x)dx and β j,k = 1 0 F (G -1 (x))ψ j,k (x)dx. We have, for any x ∈ [0, 1], F (x) -F (x) = 2 j 0 -1 k=0 (α j 0 ,k -α j 0 ,k )φ j 0 ,k (G(x)) + j 1 j=j 0 2 j -1 k=0 βj,k 1 {| βj,k |≥κρn} -β j,k ψ j,k (G(x)) - ∞ j=j 1 +1 2 j -1 k=0 β j,k ψ j,k (G(x)).
We now need the following lemma which is an immediate consequence of [20, Lemma 2] and the Minkowski inequality. Lemma 6.2 ( [START_REF] Kerkyacharian | Regression in random design and warped wavelets[END_REF]) Suppose that (2.3) holds. Then, for any sequences (u j,k ) ∈ ℓ 2 (N 2 ) and any integers j 0 and j 1 such that j 1 > j 0 ≥ j 0 , there exists a constant C > 0 such that

1 0   j 1 j=j 0 2 j -1 k=0 u j,k ψ j,k (G(x))   2 dx ≤ C    j 1 j=j 0 2 j/2   2 j -1 k=0 u 2 j,k w j,k   1/2    2 ,
where w j,k is defined by (3.2).

It follows from Lemma 6.2 and the Cauchy-Schwarz inequality that

E 1 0 F (x) -F (x) 2 dx ≤ C(F + G + H), (6.9)
where

F = 2 j 0 2 j 0 -1 k=0 E (α j 0 ,k -α j 0 ,k ) 2 w j 0 ,k , G =    j 1 j=j 0 2 j/2   2 j -1 k=0 E βj,k 1 {| βj,k |≥κρn} -β j,k 2 w j,k   1/2    2 and H =    ∞ j=j 1 +1 2 j/2   2 j -1 k=0 β 2 j,k w j,k   1/2    2 .
Using Proposition 6.1 and 2 j 0 -1 k=0 w j 0 ,k = 1, we obtain .11) Let us now bound the term G. Observe that

F ≤ C 1 n 2 j 0 2 j 0 -1 k=0 w j 0 ,k ≤ C ln n n ≤ C ln n n 2s/(2s+1) . (6.10) Since F ∈ B w s,∞ (M ), we have H ≤ C   ∞ j=j 1 +1 2 -js   2 ≤ C2 -2j 1 s ≤ C (ln n) 3 n 2s ≤ C ln n n 2s/(2s+1) . ( 6
G ≤ C(G 1 + G 2 + G 3 + G 4 ), (6.12)
where

G 1 =    j 1 j=j 0 2 j/2   2 j -1 k=0 E βj,k -β j,k 2 1 {| βj,k |≥κρn} 1 {|βj,k|<κρn/2} w j,k   1/2    , G 2 =    j 1 j=j 0 2 j/2   2 j -1 k=0 E βj,k -β j,k 2 1 {| βj,k |≥κρn} 1 {|βj,k|≥κρn/2} w j,k   1/2    , G 3 =    j 1 j=j 0 2 j/2   2 j -1 k=0 E β 2 j,k 1 {| βj,k |<κρn} 1 {|βj,k|≥2κρn} w j,k   1/2    2 and G 4 =    j 1 j=j 0 2 j/2   2 j -1 k=0 E β 2 j,k 1 {| βj,k |<κρn} 1 {|βj,k|<2κρn} w j,k   1/2    2 .
Upper bounds for G 1 + G 3 . Note that Since 2 j -1 k=0 w j,k = 1, we have We have . (6.17)

| βj,k | < κρ n , |β j,k | ≥ 2κρ n ⊆ | βj,k -β j,k | > κρ n /2 , | βj,k | ≥ κρ n , |β j,k | < κρ n /2 ⊆ | βj,k -β j,k | > κρ n /2 and | βj,k | < κρ n , |β j,k | ≥ 2κρ n ⊆ |β j,k | ≤ 2| βj,k -β j,k | . So G 1 + G 3 ≤ C    j 1 j=j 0 2 j/2   2 j -1 k=0 E βj,k -β j,k 2
G 1 + G 3 ≤ C 1 n 2    j 1 j=j 0 2 j/2   2 j -1 k=0 w j,k   1/2    2 = C 1 n 2   j 1 j=j 0 2 j/2   2 ≤ C 1 n 2 2 j 1 ≤
G 2 ≤ C(G 2,1 + G 2,
Combining (6.9), (6.10), (6.11) and (6.17), we have .

The proof of Theorem 5.1 is complete.

Figure 1 :Figure 2 :Figure 3 :Figure 4 :

 1234 Figure 1: Four target cumulative distribution functions: F0.2, F1, F5, F50 (from left to right)

Figure 5 :

 5 Figure 5: Random thresholds (lower horizontal bars), deterministic thresholds (higher horizontal bars), wavelet detail coefficients of F50 (first row of graphics), wavelet detail coefficients of the (δi)s (second row of graphics)

Figure 6 :Figure 7 :Figure 8 :Figure 9 :Figure 10 :Figure 11 :

 67891011 Figure 6: Uniform design: estimators WWEd, WWEr, PPEd, PPEr (left to right) for targets F0.2, F1, F5, F50 (from top to bottom)

(l + l 2 2

 2 ln n] with u > 0 (chosen later). Proceeding as in the bounds of S and T 1 in the proof of Proposition 6.1 with l instead of n, -j ) ≤ C max l∈{1,...,2m}

1. 2 1 1 / 2 P 2 1/ 2 ≤ C 2 j 1 n 1

 212221 {| βj,k -β j,k |>κρn/2} w j,kIt follows from the Cauchy-Schwarz inequality, Proposition 6.2, Proposition 6.3 and2 j ≤ 2 j 1 ≤ n that E βj,k -β j,k {| βj,k -β j,k |>κρn/2} ≤ E βj,k -β j,k 4 | βj,k -β j,k | > κρ n /

2 . 2 ≤ 2 . 2 .

 2222 Using 1 {|βj,k|>κρn/2} ≤ 1 and2 j -1 k=0 w j,k = 1, C2 -2j 2 s ≤ C ln n n 2s/(2s+1)Let j 2 be the integer(6.14). ThenG 4 ≤ C(G 4,1 + G 4,2Using β 2 j,k 1 {|βj,k|<2κρn} ≤ Cρ 2 n and 2 j -1 k=0 w j,k = 1, we haveG 4,1 ≤ Cρ 2

E 1 0F

 1 (x) -F (x) 2 dx ≤ C ln n n 2s/(2s+1)

Université de Caen, LMNO, Campus II, Science 3, 14032 Caen France

Aix Marseille Université, CNRS, Centrale Marseille, LATP, UMR 7353, 13453 Marseille France

Acknowledgments. The authors would like to thank Yves Rozenholc for providing us programs for the implementation of the piecewise polynomial regression estimator, and the reviewer for helping us to improve the paper.


Syed Zulkarnain
email: syed-zulkarnain.syed-idrus@ensicaen.fr

Syed Idrus

Estelle Cherrier
email: estelle.cherrier@ensicaen.fr

Christophe Rosenberger
email: christophe.rosenberger@ensicaen.fr

Jean-Jacques Schwartzmann
email: jean-jacques.schwartzmann@ensicaen.fr

A Review on Authentication Methods

Keywords: Information technology, user authentication, online services, cryptography, biometrics

. This paper provides an overview on existing authentication methods, and its pros and cons when designing an online service.

Introduction

For the past two decades, computer networks have grown at an explosive rate. In a wide range of environments, such networks have become a mission critical tool. Organisations are building networks with larger scales than ever before, and the connectivity with the global Internet has become indispensable. Along with this trend has come an explosion in the use of computer networks as a means of illicit access to computer systems [START_REF] Goyal | The n/r one time password system[END_REF][START_REF] Liao | A one-time password scheme with qr-code based on mobile phone[END_REF]. Internet is known as a very powerful platform that changes the way we communicate and perform business transactions in current technology (Syed Idrus et al., 2008;[START_REF] Syed Idrus | Database encryption for a web-based claims system[END_REF]. It has now touches every aspect of our lives along with emerging of newer security threats, ready to embark towards the journey of destructions. According to the Internet World Stats, as of June 30, 2012, over 2.4 billions users are using the Internet, and hence the numbers no doubt will keep on increasing. Thus, the advent of information securities has revolutionised our life particularly with the information that are available, whereby data can easily be accessed and manipulated [START_REF] Syed Idrus | The development of a web-based claims system[END_REF], 2012a). Transmitted information level is becoming more important especially as interactions that used to only be carried out offline, such as bank and commercial exchanges are now being carried out online in the form of Internet banking and electronic commercial exchanges, and damages due to such attacks will be greater [START_REF] Cha | Password generation of otp system using fingerprint features[END_REF][START_REF] Davaanaym | A ping pong based one-time-passwords authentication system[END_REF]. As increasing amounts of personal information are surfacing on the Web, it is essential to remain wary of the risks surrounding the ease in which our private details can be accessed. Social networking and online profiles contribute to this: giving potential intruders a plethora of sensitive information. Insafe reports that more than a quarter of children in Europe have online networking profiles which can be exposed, and with over 900 million people on Facebook alone the danger is widespread [START_REF] Parris-Long | Safer internet day: Why every generation has a role to play in keeping the web secure[END_REF].

'It is good to be wary about publishing your personal information even if other people are happy to post pictures of their house or their contact details -remember what goes online, usually stays online' [START_REF] Parris-Long | Safer internet day: Why every generation has a role to play in keeping the web secure[END_REF].

The aim of this paper is threefold. Section 2 deals with the concepts and definitions of authentication. In Section 3, it is devoted to a survey of some of the existing authentication methods. We make some comparisons between different authentication methods, discuss in Section 4. In this paper, we are interested to discover the advantages, disadvantages and also an arbitration towards the existing methods but our focus is on biometrics, specifically to keystroke dynamics. We also discuss about the future trends of authentication.

Concepts and Definitions of Authentication

Before presenting the different existing methods, we give some definitions and concepts. The concepts listed below are partially based on the result of [START_REF] Menezes | Identification and Entity Authentication, chapter 10[END_REF] and [START_REF] Chabaud | Authentication, a model of human machine authentication[END_REF]. The authentication process implies different entities:

• The claimant is the entity that authenticates to the system, in order to use the services. It could be a person or an Information System (IS);

• The monitor is the entity that provides an authentication service. It asserts the identity of a claimant (or reject it in case of a wrong authentication) and checks if it can grant him/her the use of the required service;

• The Information System (IS) provides services, such as an access to a computer account, an application, a door unlocking or a network printer, and will let the claimant use its services if the monitor correctly authenticated it (with a given required level of trust).

Example: A worker needs to access his/her place of work. The main door is secured with an authentication token. The lock contains a token reader and triggers the unlocking of the door if the token is presented to the reader and if the verification system estimates that this worker is allowed to access. In that case, the claimant is the worker, the monitor is the verification system, and the function provided by the IS is the unlocking of the door.

The Authentication Concept

'Identification', 'authentication' and 'authorisation' are three interrelated concepts, which form the core of a security system. Identification is the communication of an identity to an IS. Before authentication, the claimant typically provides the IS an identity anyway (for example, a login or an email address), and the monitor asserts the identity by authentication (for example, using a password). An authentication is a proof given by a claimant to assert a monitor that he/she really corresponds to the identity he/she provided. The monitor then asserts the IS of the identity of the user. Finally, the authorisation is the granted privileges given to the user.

Authentication systems provide the answers to both questions: (i) who is the user? and (ii) is the user really who he/she represents himself/herself to be? Hence, authentication represents one of the most promising way concerning trust and security enhancement for commercial applications. It also denotes a property of ensuring the identity of the previously mentioned entities [START_REF] Kotzanikolaou | Network Security Current Status and Future Directions, chapter Computer Network Security: Basic Background and Current Issues[END_REF]. Besides, authorisation is a process of giving individuals an access to the system objects based on their identity. Authorisation systems provide the answers to the three questions: (i) is user U authorised to access resource R?; (ii) is user U authorised to perform operation O?; and (iii) is user U authorised to perform operation O on resource R?

There is often a confusion between 'identification', 'authentication' and 'authorisation'. These words/terms do not have the same meaning at all. Each of these concepts requires an enrolment step. Enrolment is the 'registration' of a new user, including the emission of tokens and credentials. Enrolment is a major concern and should also be carefully handled. In the rest of this paper, we will consider the IS has already registered the claimant.

Example: Let us consider the same example as the previous one. When the user authenticates himself with his token, he provides his identity by putting his card, which contains an identification number linked to his account. The system does not need to know the full description of the worker, so a simple identification number is enough. Then, the card authenticates to the reader (for example, by a symmetric cryptographic protocol), to prove the authenticity of the provided identity. Finally, the authorisation will be given to the user to go through the door, if he has the right to do it.

Having said that, we then need to have a link between both the claimant and the monitor. This link is denoted channel. A channel is a support of communication between the claimant and the monitor. It can either be considered as confidential, authentic, secure or as insecure. A confidential channel is resistant to interception; an authentic channel is resistant to tampering; a secure channel is resistant to both; and an insecure channel is none. The authentication goal is to assert an identity, but the scope of authentication methods is very large and it can vary in many ways. Below is a list of some of the common authentication methods:

• An ID (IDentification)/password: to open a session on a computer or to authenticate on Internet;

• A PIN (Personal Identification Number) code: to unlock a smartcard;

• An RFID card: for accessing a building;

• A fingerprint: to unlock a door;

• A facial recognition system with a webcam: to open a session on Internet;

• A USB token;

• A one-time password token;

• etc. . . Each one of the authentication methods has a specific use and inherent drawbacks. Tokens can be stolen, facial recognition systems can be broken by presenting a photo of the genuine user. . . It concerns the trustability of the authentication method. In consequence, the goal of authentication is to verify the identity of an entity with a given level of trust. If an authentication method cannot be fully trustable, the provided verification cannot be either. Even a good authentication technique will not be secured if the implementation allows backdoors (see Figure 1).

Basic Steps For Authentication

The common basic steps for authentication are:

1. Initial step: the claimant is unauthenticated.

2. Connection step: the claimant requires to the IS the use of a function that requires an authentication. The IS asks the monitor to authenticate the claimant.

3. Authenticated step: the claimant is authenticated and a session is opened. The IS provides the user the required functions.

4. Disconnection step: the user disconnects or is disconnected from the monitor and the state returns to the initial step. This step can be initiated on a time out or by an action of the user.

An IS may require different levels of authentication, for example, a level for the administrators and a level for the users. In such a system, the level of authentication is graduated on a scale: level 0 for an unauthenticated user with the lowest rights in the system; level N for the administrator with full rights; and one or multiple levels between 0 and N.

Here, the scheme is that an authentication could be required to switch to a higher level of trust in the claimant by the IS. The provided security of an authentication method depends on usability and acceptability. If the usability is bad, the users will rapidly find ways to bypass the authentication steps for a convenient use. This will lead inevitably to a failure of the system, so it should be considered as a critic.

Example 1: In a facility, the door of the warehouse is unlocked by a token associated with a PIN. In this scheme, users that constantly carry heavy packages will rapidly put a piece of cardboard to block the door open.

Example 2: A user of an enterprise has to open a session on his/her computer. The administrator has set the inactivity timeout before unlocking it in two minutes and has imposed highly secured passwords (minimum sixteen characters, changes every week). An average user will rapidly stick a post-it with his/her password on the top of his/her computer.

The authentication process can be based on a combination of one or more authentication factors. The four (widely recognised) factors to authenticate humans are:

1. Something the user knows: a password, a passphrase, a PIN code, the mother's maiden name. . . 2. Something the user owns: a USB token, a phone, a smartcard, a software token, a navigator cookie. . .

3.

Something that qualifies the user: a fingerprint, DNA fragment, voice pattern, hand geometry. . . 4. Something the user can do: a signature, a gesture. . . But now, perhaps we could include a 'fifth' authentication factor: "Somewhere the user is: a current location/position, a current time information. . . "

Authentication Factors and Strengths

Using more than one factor to authenticate a user is sometimes related as a strong authentication, but the strength of the authentication is more related to the strength of underneath authentication methods, to be more precise: "Two-Factor Authentication" (TF-A). For example, a TF-A implies to a navigator cookie (what you own) and the ability to provide the mother's maiden name (what you know) is a TF-A, but is not a strong authentication, as both authentication methods can be easily compromised. Another alternative factors could be:

• A spatiotemporal authentication: the user can be given access to his/her work place only at some predefined times and locations;

• A web of trust: a reputation could be a factor for authenticating in some cases;

• A Turing test [START_REF] Turing | Computing machinery and intelligence[END_REF] could be considered as an authentication as a human instead of a computer (a CAPTCHA is an example of a Turing test).

An authentication and an electronic signature (or Message Authentication Codes (MACs)) are nearby notions. An electronic signature is nothing else but the authentication of the source of a message. The main difference resides in the fact that authentication is related to a timestamp, as it authenticates the presence of the identified user trough a channel, the fact that it is by nature and not definitive. Moreover, authentication messages generally concerns the claimant identity and not necessarily any other meaningful message, whereas electronic signatures are directly related to a message.

A Survey of Existing Authentication Methods

A person's authentication can be the means of accessing a computer or a software on computers or websites. For example, he/she may be asked by the system to provide their username and password [START_REF] Obaidat | Keystroke Dynamics, chapter 10 -Keystroke Dynamics Based Authentication[END_REF][START_REF] Bours | Continuous authentication using biometric keystroke dynamics[END_REF]. The most common solution for today's electronic authentication is the use of a username and password [START_REF] Davaanaym | A ping pong based one-time-passwords authentication system[END_REF]. In order to get some money out, say, from the Automated Teller Machine (ATM), we need a bankcard and a personal identification number (PIN). Besides, some airports have imposed fingerprints or iris scans for authenticating passengers [START_REF] Bours | Continuous authentication using biometric keystroke dynamics[END_REF]. For traveling security purposes, most countries have now compelled biometric in their passports, and Malaysia was the first country in the world to issue and implement biometric passports, also known as an e-passport in 1998, after a local company, IRIS Corporation, developed the technology (Wikipedia, 2011b).

The well-known ID/password is far the most used authentication method. It is widely used despite its obvious lack of security. This fact is due to the ease of implementation of this solution, and to the instantaneous recognition of that system by the users that facilitates its deployment and acceptance. However, there are several existing password-based authentication schemes that have been introduced and the earliest was by [START_REF] Lamport | Password authentication with insecure communication[END_REF].

Some authentication methods rely on concepts defined by cryptography, however this is not a general rule. Authentication is a critical function in IS as it gives access to the services provided by the IS. The whole security of a system depends on the level of guarantee provided by the authentication method in place. There are no perfect authentication methods, as they are subject to antagonist needs: security, usability, acceptance, cost. . . The usability and the cost of the provided authentication methods are major concern, as the level of satisfaction of the users can impact the correct use of the system. The acceptance of authentication methods is the way it is perceived by the user. All those issues should be evaluated before any deployment of an authentication method.

There are various different authentication methods. But in this paper, we present an (almost) complete overview of some of the available authentication methods discuss in Subsection (3.1) to (3.5) namely static authentication by a shared secret; one-time password token; cryptographic challenge-response based authentication; radio frequency identification; and biometrics. We also elaborate further about their use, limitations and potential benefits, and drawbacks.

Static authentication by a shared secret

The static authentication is best known through its major implementation: the ID/password form based authentication, as it is a commonly used solution to verify the identity of a demander (see Figure 2). In the general scheme of static authentication, the claimant proves the monitor he/she knows a shared secret, generally by revealing it to the monitor. The monitor then compares it to a value stored in a verification table to reveal if it is the right value. A shared secret can be:

• A password: a list of characters, either meaningful or not, generally between six and ten characters in length;

• A passphrase: often used very similarly as a password, but as it is longer it maximises the key space, providing a better security;

• A pass code: it is a purely numeric password, often used to authenticate the holder of a smartcard (PIN code);

• A non-text based pass: graphical passwords [START_REF] Suo | Graphical passwords: A survey[END_REF], mouse-movement based. . . ;

• A big number or an array of randomly chosen bytes: for machine to machine authentication.

Figure 2: The shared secret is far the most employed method of user authentication.

Static authentication suffers from many drawbacks as it is considered as a low-security solution when used on its own or without precaution:

• Password can be stolen online by an eavesdropper and used in order to gain access to the system (replay attack);

• Physical attacks can easily be done, by a camera recording a PIN sequence as it is being typed, or by a keylogger (either software or hardware) to record a password on a computer;

• Passwords are also vulnerable to guessing attacks, like brute force attacks or dictionary attacks. However, it is possible to limit the scope of these attacks by adding a delay of about one second before entering the password and after entering a wrong password;

• A stolen password hash could sometimes be reverted, for example, by using a list of precomputed hashes of the most common passwords or more sophisticated attacks like using rainbows-tables;

• Passwords can easily be revealed by a user to another (but most authentication methods can also be shared).

Increasing the password strength is a solution to avoid dictionary attacks or to make brute force attacks infeasible. It is generally accepted that the length of the password determines the security it provides, however, it is not exactly true: the strength of the password is rather related to its entropy. In [START_REF] Burr | Electronic authentication guideline[END_REF], the authors provide a further discussion on password entropy, and the feasibility of such attacks on passwords. For example, a user choose, say, a password of seven characters is said to provide between sixteen and twenty eight bits of entropy.

A password transmitted from the demander to the monitor, without any encryption is considered as a clear password. Despite it is widely used, this technique suffers from an obvious lack of security. An eavesdropper can intercept the password (for example, on Internet or intranet), and easily replay it in order to gain access to the IS.

Therefore, the main concern about passwords is the lack of security of their transmission over a channel, the best way to overcome this problem is for the claimant to prove that he/she knows the password without having to send it over the channel. Next, we introduce about one-time passwords (OTPs), which are an evolution of the ID/password system.

One-time password token

The main drawback of static passwords is their lack of protection against replay attacks, hence, the purpose of the OTP mechanism is to annihilate the replayability of passwords with the generation of a new password for each use. OTP systems can be considered as a bridge between a static password authentication and a better authentication method. It facilitates the migration of legacy applications that were designed to rely only on passwords (mainframes, websites, the IS of an organisation. . . ). The only impacted component is the monitor, and the IS does not need any change. An OTP token generally consists in a device with an LCD (Liquid-crystal Display) screen, which displays alphanumeric characters. It can have a button to generate OTPs, and some are locked by a PIN code (whose keyboard is either directly on the device either on the reader), so they can be considered as TF-A.

As OTP generates a password, the verification requires synchronisation between the token and the monitor. There are several categories of OTP, depending on counter synchronised, time synchronised, involving a secure channel, or with a shared list of passwords. A counter synchronised OTP, sometimes also called "Mathematical hash chain OTP" or "Mathematical key chain OTP", often implies to a token with a button on it (see Figure 3). Each press on the button generates a new password that can be used to log on. Most are based on the Leslie Lamport-scheme [START_REF] Lamport | Password authentication with insecure communication[END_REF]. Secondly, in a time synchronised OTP, the token has an internal clock and so as the monitor (see Figure 3). New passwords are generated from the value of the current timestamp, rather than on a shared secret or a previous password. The value of the generated password usually changes every one or two minutes. Thirdly, an OTP can also be sent to the claimant through a secure channel. The claimant has to be authenticated through an unsecured channel, but the monitor could provide the claimant with a random OTP through a third party channel, which is considered as secured, where the claimant is already authenticated. The claimant then sends back the OTP through the unsecure channel to prove his/her identity to the monitor. Finally, with a shared list of password, the claimant and the monitor share copies of the same unpredictable list of passwords. If the list is ordered, the only allowed passwords are those following the last one used, and if it is not, each password from the list can be used only once.

Another form of an authentication method is a cryptographic challenge-response based authentication. We discuss about this method in the next subsection as to why this method of authentication is considered as efficient.

Cryptographic challenge-response based authentication

PAP (Password Authentication Protocol) is a simple protocol for authentication over a network, which sends clear passwords and identifiers over the network. Subsequently, CHAP (Challenge Handshake Authentication Protocol) is an improvement of PAP, but it still requires transmitting a hashed password. The main idea of a challenge-response based authentication is that the claimant proves he/she knows the secret without sending it clear over the channel. Thus, CHAP is a challenge-based authentication protocol, but the transmission of a hashed password is still a problem due to brute force and dictionary attacks [START_REF] Ratha | Enhancing security and privacy in biometricsbased authentication systems[END_REF][START_REF] Uludag | Biometric cryptosystems: issues and challenges[END_REF]. Besides, hashed passwords still contain a lot of information about the secret password. The main response to solve that problem is the use of cryptography, either symmetric [START_REF] Daemen | Permutation-based symmetric cryptography[END_REF] or asymmetric in order to implement a challenge-response authentication. Generally speaking, a challenge-response authentication system is a system that issues a "challenge" on the client request i.e. challenge in this context: question of identification, and verifies it in the "response" of the claimed identity i.e. response in this context: provide a prove of identification.

In the symmetric case, the monitor sends a challenge to the claimant. The challenge can be a large integer, an array of integers. . . Generally, the claimant then enciphers the challenge with the shared key and sends the result back to the monitor, which compares the result with the one it has also calculated. In the asymmetric case, the claimant owns a private key associated with a certificate that contains the relative public key. The claimant provides the monitor his/her certificate (and his/her public key). The monitor sends a random number as a challenge, and the claimant uses its private key to sign the challenge (or to encipher it), and sends the result back to the monitor. The monitor then verifies the signature with the public key (or decipher the response) to check the challenge was verified.

The main challenge on the claimant side is to protect the private key (or the shared key) of the user. To do so, a piece of software on the claimant computer can seal the private key with a password or a passphrase on the user's device. Another solution is to use a secure element with a sealed storage of the keys: smart card, USB secured Token, TPM (Trusted Platform Module). . . Such hardware components handle the cryptographic computing involving the private key of the user. The authentication of the user to the smartcard can be required to unlock the cryptographic service. It can be done by a PIN code or by biometrics (see Figure 4). Cryptographic challenge-response based authentication is a very efficient and confident authentication method, if implemented correctly. However, on the monitor side, the maintenance of the PKI (Public-key Infrastructure) can be very time, energy and money consuming. Subsequently, a common means of authentication is by using the Radio Frequency IDentification (RFID), which is a technology for transmitting data from devices called RFID tags to a specific reader. In the following subsection, we define how this method can help the users in communication capabilities, especially via Internet.

Radio Frequency IDentification

The first generation of RFID tags was used in the 1950s for a military purpose, but it was limited to an identification purpose. At that time, their use was limited to the transmission of a serial number wirelessly over radio waves. In the past few years, RFID tags have been a large success in industry, and their use became common. Application range of RFID tags is very large: item identification for inventory data, supply chain management, phones with RFID capabilities, authentication plastic cards. . . It is said that we rely to an Internet for things, and hence, RFID tags will help moving toward this way by adding communication capabilities to common items. The presence of RFID tags in the everyday life has just begun. For example, a credit card with a built-in RFID system could be debited by a wireless POS (Point of Sale), even if the card is still in the bag of its owner. The classical protection against those attacks is a PIN code printed on the card, which is needed to unlock the chip. So the attacker will need to have the card in hand to read the code. Such a protection is used for RFID passports (biometric passports).

Having mentioned biometrics, we elaborate about this method of authentication and how this technology has a strong link in relation to ourself, in the subsequent subsection. It is considered as a trustable security systems that can be an alternative to password-based security system.

Biometrics

In computer science, in particular, biometrics is used as a form of identity access management and access control [START_REF] Yang | Biometrics[END_REF]Wikipedia, 2011a). However, biometrics is an ancient Greek word and is the combination of two words (bio) means life, (-metric) means measurement. According to (Wikipedia, 2011a), biometrics has been around since about 29,000 BC when cavemen would sign their drawings with handprints. In 500 BC, Babylonian business transactions were signed in clay tablets with fingerprints. The earliest cataloging of fingerprints dates back to 1891 when Juan Vucetich started a collection of fingerprints of criminals in Argentina. However, it is said that the history of biometrics techniques originated in China in the 14th century. It was a form of finger printing as reported by the Portuguese historian Joao de Barros. The Chinese merchants were stamping children's palm and footprints on paper with ink to distinguish babies [START_REF] Bhattacharyya | Biometric authentication: A review[END_REF].

Biometrics is a science that consists of methods for uniquely recognising humans based upon one or more intrinsic physical or behavioural traits [START_REF] Jain | Introduction to Biometrics: Personal Identification in Networked Society[END_REF][START_REF] Yang | Biometrics[END_REF]Wikipedia, 2011a). It has become one of the popular and trustable security systems that have become an alternative to password-based security system. Biometrics techniques have been developed for a machine-based verification of the identity of a person [START_REF] Prabhakar | Biometric recognition: security and privacy concerns[END_REF]. Biometrics characteristics can be divided into three main classes namely 'Morphological', 'Behavioural' and 'Biological' [START_REF] Yang | Biometrics[END_REF]. Morphological is related to the shape of the body such as retina, voice, prints (finger, thumb, palm), iris, hand geometry, face recognition, ear, height, weight, skin, veins, gender. . . Behavioural is related to the behaviour of a person such as gait, signature, keystroke dynamics, voice, driving, gaming. . . Biological is related to the inner part of a living organism such as heart beat, odour, DNA, blood. . . (see Figure 5). Voice can be categorised in both morphological and also behavioural trait because every person has a different vocal tract, but voice recognition is mainly based on the Biometric recognition is largely studied in computer science. The use of biometric techniques, such as face, fingerprints, iris and ears is a solution for obtaining a secure personal authentication method [START_REF] Yang | State of the art in Biometrics[END_REF]. Biometrics uses the authentication factors, which are methods based on something that qualifies the user and something that he/she can do. The main advantage of these authentication methods is that there exists a strong relationship between the individual (user) and its authenticator (biometric data). Furthermore, it is difficult to copy the biometric characteristics of an individual compared to most of other authentication methods. Nonetheless, there is a drawback in biometric authentication, which is the uncertainty of its verification result, for example, in fingerprints authentication; there could be a possible error due to bad positioning of the finger [START_REF] Mcquay | Security in Computing and Networking Systems: The State-of-the-Art (Textbook), chapter 27 -An Overview on Biometric Authentication[END_REF].

Each time a user authenticates himself/herself, he/she provides a biometric information with its reference. This information is generally similar at each authentication attempt. An attacker could intercept the information and replay it. Therefore, the solutions to this predicament have to be dynamic. In [START_REF] Simske | Dynamic biometrics: The case for a real-time solution to the problem of access control, privacy and security[END_REF], the author defined that dynamic biometrics is known as a dynamic means of granting access rights that must exist. There are several ways to achieve this such as by defining a generalisation of a challenge-based password for biometrics, one-time password authentication scheme or perhaps free text on keystroke dynamics, and hence to achieve a system with a lighter workload and higher security.

Biometric authentication can be summarised in two steps namely enrolment and authentication. The stage of the enrolment is where the user provide his/her biometric data. The biometric data will be captured and then, the features will be extracted and stored into the database. During the authentication process, the stored features will be compared with the ones currently presented for an access. If it matches, then, an access will be granted. For example, in keystoke dynamics, during the enrolment stage, the users are asked to provide their way of typing i.e. by typing given a password or a passphrase on a keyboard between 5 to 10 times. Because keystroke dynamics is a behavioural biometrics, hence, it has to be done collectively i.e. several number of times because each time, the way the users type a password/passphrase, their typing rythm may differ slightly.

As mentioned by [START_REF] Simske | Dynamic biometrics: The case for a real-time solution to the problem of access control, privacy and security[END_REF], we are proposing keystroke dynamics as a solution, especially for password-based authentication. Keystroke dynamics is an interesting and a low cost biometric modality as it enables the biometric system to authenticate or identify an individual based on a persons way of typing a password or a passphrase on a keyboard. It belongs to the class of behavioural biometrics, in the sense that the template of a user reflects an aspect of his/her behaviour, as mentioned earlier. Generally speaking, the global performances of keystroke dynamics based authentication systems are lower than those of popular morphologic modalities based authentication systems (such as fingerprints, iris, etc. . . ). We use the GREYC Keystroke software [START_REF] Giot | Greyc keystroke: a benchmark for keystroke dynamics biometric systems[END_REF] to capture biometric data as shown in Figure 6.

However, there is no single biometric modality expected to effectively satisfy the needs of all authentication applications (usability, security, cost. . . ). Subsequently, a vast number of biometrics have been proposed, researched, analysed and evaluated [START_REF] Jain | Introduction to Biometrics: Personal Identification in Networked Society[END_REF]. Thus, each biometric has its strengths and limitations, therefore, the respective biometric invokes to specific authentication applications [START_REF] Jain | Introduction to Biometrics: Personal Identification in Networked Society[END_REF][START_REF] Stallings | Computer Security: Principles and Practice[END_REF]. Although each of these biometric methods, to a certain level, possess the desirable properties and has the potential of becoming a valid biometric technique [START_REF] Newham | The biometric report[END_REF], many of them cannot be acceptable as an indisputable evidence of identity "in the court of law". The acceptability of a biometric system as an application that is often compromises between various perceptions or Figure 6: GREYC Keystroke Software verbotens of community sensitivity and the value or convenience offered by a biometric-based authentication [START_REF] Jain | Introduction to Biometrics: Personal Identification in Networked Society[END_REF].

The common problem of personal authentication raises a number of important research issues such as "which technologies are the most effective to achieve accurate and reliable authentication of individuals?" Some of these problems are well-known open problems. As examples, in pattern recognition and computer vision, it need a systematic crossdisciplinary effort compared to other authentication methods. Therefore, biometric technology alone may not be sufficient in order to solve these issues effectively, thus the solutions to the outstanding open problems may lie in the innovative engineering designs exploiting the constraints. Otherwise, it would be unavailable to the applications and in harnessing the biometrics technology in combination with other allied technologies [START_REF] Jain | Introduction to Biometrics: Personal Identification in Networked Society[END_REF].

In order to prevent information from being accessed by illegitimate or unauthorised users, remote user authentication is certainly one of the most important service [START_REF] Liao | A one-time password scheme with qr-code based on mobile phone[END_REF]. However, a major concern with the morphological-based biometrics is that if it can be copied by the impostor using, say, deceit or force, the authentic user would be faced with a life-long loss of identity [START_REF] Woodward | Biometrics: Privacys foe or privacys friend[END_REF]. If this phenomenon ever happens, the consequences could be disasterous.

Comparative Study

All authentication methods are different. None of them has the same usage and each one will respond to specific needs. Moreover, different implementations of the same authentication method will provide very different levels of security. For example, even the theoretically strongest authentication method, if the enrolment stage is poor, will likewise provide a poor reliability on the asserted identities. Each authentication method still has intrinsic advantages and problems. Table 1 illustrates a comparative study of general (and generic) authentication methods, on several different criteria. The criteria are:

• The observed popularity is the overall proportion of implementations of an authentication method among all implementations of authentication methods;

• The device cost is the cost of the per user equipment. It includes, if any, tokens, readers, and their life span;

• The infrastructure cost is the cost of the setting up of such an authentication method in an IT architecture, and to maintain the authentication system operational. It includes costs for the user assistance, devices replacement, enrolment of news users, and revocation of users;

• The ease of use is the general usability of the authentication method: the user acceptance, the token and its form factor, the potential availability of the system (for example, it could be different for an online or an offline system). Ease of use is a critical criterion as it is commonly the first cause of failure of the establishment of an authentication method in an IT system;

• The general security is an evaluation of the security (and of the potential failures) provided by the authentication method, on major cases. It is a very subjective evaluation (but, not the case for cryptography-based solutions), and should be considered as an average for the authentication method.

The comparison points out some interesting facts about authentication processes and deployments as illustrated in Table 1. We can notice that the observed popularity of authentication methods is more related and the low infrastructure costs can also be explained that it is more widespread, than popular. It is likewise, at least for that specific modest set of authentication methods, inversely proportional to the level of security it provides. The direct linkage between popularity and ease of use demonstrates how ease of use is crucial for a deployment of any authentication method. The cost is generally proportional with the general security it provides. That implies that it could be a good solution to share strong authentication solutions (monitors) between different Information Systems. [START_REF] Josang | Weak and strong passwords: When to use them, and how to protect them[END_REF]) also explained how we can protect and when we can use the weak and strong passwords given the levels of authentication assurance in security systems. However, authentication on Internet could be done by using technologies that rely on user centered software solutions.

Authentication of users on web sites is a major concern, as there is no ideal solution to solve it. This problem is due to the underlying protocols and client: HTTP is not adapted to authenticate users, neither is HTML to handle authentication interaction with users. Based on that fact, new solutions began to emerge.

Conclusions and Future Trends

The first future trend is of course to increase the security of information systems through a secure authentication of the individual. Meaning that we want to be as sure as possible that the claimant is not an impostor.

The different authentication solutions that could be deployed must be very simple for a client. Authentication is part of the human machine interface for any software applications. The ease of use is important for the logical access control step but also for the enrolment one. As for example, some information systems require a strong password that shall include a combination of uppercase and lowercase letters, numbers, and symbols (see Figure 7). If the password is not strong enough the individual is asked to choose another one. This is generally inconvenient for the user to define such a password and to remember it [START_REF] Park | User authentication protocol based on human memorable password and using rsa[END_REF]. Industrial and researchers generally define very efficient and secure authentication solutions as a technical point of view. A good practical solution shall consider some usability aspects during the development step. For many ergonomic or cultural reasons, an authentication method would not be accepted by users. As illustration, even password typing can be reluctant for some users. Human memory is in conflict with most password policies [START_REF] Mehler | Improving usability through password-corrective hashing[END_REF]. In [START_REF] Sasse | Transforming the weakest link ? a human/computer interaction approach to usable and effective security[END_REF], the authors note usability problems with password authentication, such as the number of passwords a user has to remember, strict password policies, varying systems, and memory demands. Users rarely completely forget a password. Many human factor studies of data entry methods have been realised in the past.

Thus, a biometric system is essentially a pattern recognition system. Biometric authentication systems necessitate much more operations for the enrolment step than defining a static password as for example. Nevertheless, the verification step is much more convenient for the user as he/she is generally requested to show one morphologic characteristic such as one fingerprint or its face i.e. which makes a personal authentication by determining the authenticity of a specific morphological or behavioural characteristic possessed by the user.

Therefore, for us, the only user authentication method solution is biometrics. We propose to utilise keystroke dynamics in order to avoid password-based authentication problems. The results that we obtained from our previous studies [START_REF] Syed Idrus | 9th Summer School for Advanced Studies on Biometrics for Secure Authentication: Understanding Man Machine Interactions in Forensics and Security Applications[END_REF][START_REF] Syed Idrus | Soft biometrics for keystroke dynamics[END_REF] could be used as a reference model to assist the biometric system to better recognise a user by a way he/she types on a keyboard. Hence, it would strengthen the authentication process by hindering an imposter trying to enter into the system. Besides, the main advantage of resorting to keystroke dynamics for authenticating users relies in its low cost. Indeed, no extra dedicated sensor is required. For example, keystroke dynamics is dealt with in the recent papers [START_REF] Giot | Keystroke dynamics overview[END_REF][START_REF] Messerman | Continuous and non-intrusive identity verification in realtime environments based on free-text keystroke dynamics[END_REF][START_REF] Bours | Continuous keystroke dynamics: A different perspective towards biometric evaluation[END_REF]. The fact that the performances of keystroke dynamics are lower than other standard biometric modalities can be explained by the variability of the users behaviour. One solution to cope with this variability is to study soft biometrics, first introduced by [START_REF] Jain | Soft biometric traits for personal recognition systems[END_REF].

Subsequently, we have conducted a couple of research works in biometrics: keystroke dynamics with new approaches using 'soft biometric' and performed several analysis in our recent articles in [START_REF] Syed Idrus | 9th Summer School for Advanced Studies on Biometrics for Secure Authentication: Understanding Man Machine Interactions in Forensics and Security Applications[END_REF][START_REF] Syed Idrus | Soft biometrics for keystroke dynamics[END_REF]. For our soft biometric criteria, we used features such as the way of typing, gender, age and handedness. The outcomes from our analysis have also showed some interesting and promising results. In [START_REF] Jain | Soft biometric traits for personal recognition systems[END_REF], the authors explained about "soft biometric traits", which are defined as "characteristics that provide some information about the individual, but lack the distinctiveness and permanence to sufficiently differentiate any two individuals". For example Jain et al. consider gender, ethnicity, and height as complementary data for a usual fingerprint based biometric system.

Another important trend is the respect of the privacy of users. In order to increase the security of an information system, one could use as many authentication factors as necessary. Even if we do not consider usability and cost aspects, this solution increases also the risk that a hacker could duplicate one authentication data. This could be an important problem for further accesses of the information system. For passwords, if you know a hacker has stolen it, it is quite simple to change it. For a fingerprint, it is not possible to change it (you have to change the used finger), but, there is a cancelable biometrics as alternative solutions. Moreover, most of time, you do not necessary know that your authenticator is compromised.

As a conclusion, all authentication methods such as password, token, biometric features and others have their own advantages and disadvantages. However, biometrics are the solutions the fact that it is the only method to authenticate the user, or the mobile phone's owner. . . .

Figure 1 :

 1 Figure 1: An authentication system seen on a Wi-Fi router that clearly indicates an attacker, which password to try first.

Figure 3 :

 3 Figure 3: Left token is a challenge type OTP card with a PIN code (CRYPTOCard c ). The one on the right is a counter synchronised OTP token (ZyXEL).

Figure 4 :

 4 Figure 4: An example of a contactless smartcard for logical access control with an embedded fingerprint sensor for match on card (E-smart Technologies).

Figure 5 :

 5 Figure 5: Characteristics of Biometrics.

Figure 7 :

 7 Figure 7: Strong password checking.

Table 1 :

 1 A comparative evaluation of some authentication methods.

	Method	Observed popularity	Average device cost	Infrastructure cost	Ease of use	General security	Disadvantages	Advantages
	Simple static password	*** ***	-	*	** **	*	Very low security, usability decreases with multiple pass-	Very low cost, portability, familiar to users.
							words.
	Strong static password	** **	-	**	*	**	Usability, still vulnerable to re-playability.	Better security than a sim-ple password.
	Certificate on a token	** *	**	*** **	** **	** **	Infrastructure costs, cost of the token.	Offline physical authenti-cation.
	Synchronised OTP generator token	** *	** *	** *	** **	** **	Device cost, form factor.	Good security, good us-ability.
		*	**	**	***	***	Acceptance, complicated revo-
	Biometrics (Fingerprints)				**	**	cation, high cost.	Good general security.

Acknowledgements

The gratitude goes to The Ministry of Higher Education (MOHE) Malaysia whom had financially supported this work. The authors would also like to express their cordial thanks to GREYC Laboratory, ENSICAEN, France and Universiti Malaysia Perlis (UniMAP), Malaysia for the supports and had made this paper possible for publication.