Designing reliable user authentication on mobile phones is becoming an increasingly important task to protect users’ private information and data. Since biometric approaches can provide many advantages over the traditional authentication methods, they have become a significant topic for both academia and industry. The major goal of biometric user authentication is to authenticate legitimate users and identify imposters based on physiological and behavioral characteristics. In this article, we survey the development of existing biometric authentication techniques on mobile phones, especially on touchenabled devices, with reference to eleven biometric approaches (five physiological and six behavioral). We present a taxonomy of existing efforts regarding biometric authentication on mobile phones and analyze their feasibility of deployment on touchenabled mobile phones.
In addition, we systematically characterize a generic biometric authentication system with eight potential attack points and survey practical attacks and potential countermeasures on mobile phones. Moreover, we propose a framework for establishing a reliable authentication mechanism through implementing a multimodal biometric user authentication in an appropriate way. Experimental results are presented to validate this framework using touch dynamics, and the results show that multimodal biometrics can be deployed on touch-enabled phones to significantly reduce the false rates of a single biometric system. Finally, we identify challenges and open problems in this area, and suggest that touch dynamics will become a mainstream aspect in designing future user authentication on mobile phones.