Mimicry Attacks Against Behavioural-Based User Authentication for Human-Robot Interaction

Abstract

Robots are often used in highly sensitive, safety-critical, or high-value applications (e.g. medical, nuclear, space, offshore, manufacturing). Where AI is not able or trusted to perform the necessary tasks, humans operators are required to train or directly control these systems. However, robots are not usually built with security as a key concern, and malicious actors need to be identified before they can cause damage or disruption through the robot’s operation. Of particular interest is ensuring whether operators of robots are who they claim to be, i.e., there is a need for identification and authentication. Traditionally, authentication is carried out through passwords or demonstrating possession of a token such as a smart card, but these are one-shot approaches and confidence in authentication wanes as time elapses. Thus, repeated authentication may be needed to provide ongoing confidence, though, in practice, such repeated actions may be highly disruptive. In this paper, we evaluate how ongoing user behaviour monitoring can be used as the basis for unobtrusive continuous user authentication, which is a form of biometric behaviour modelling. To gather data, we use a simulation in which a group of users hand-guide a robotic manipulator to perform a task (analogous to teaching by demonstration or teleoperation), with some users posing as malicious agents. We then tested our continuous authentication technique against a popular behavioural biometric attack called a ‘mimicry attack.’