Amulet: Integrating Sensitive Information Access with Identity Authentication on Mobile Devices

Mobile devices have become essential in people's daily lives, housing vast amounts of sensitive information through installed applications. To maintain security and protect user privacy, continuous user authentication is crucial even after a login session. However, previous studies have left potential vulnerabilities by separating the authentication process from operations involving sensitive information handling on mobile devices. In this paper, we present Amulet, a click-to-access authentication system that integrates access to sensitive information on mobile devices with the user's identity authentication process, providing ongoing protection against potential adversaries. By leveraging the unique physical structure of each user's finger, we capture the vibration response of their implicit identity traits during finger-screen interactions for sensitive information access. These finger-emitted vibrations (FEV) exhibit distinct and consistent characteristics, allowing us to utilize passive FEV traces for continuous user identification throughout an App's login session. To achieve flexible and robust user authentication, we decouple the FEV biometric features from position- and behavior-dependent vibrations. Our deep learning-based authentication system utilizes collected vibration signals, containing FEV characteristics, as input data. To ensure generalizability across diverse use scenarios, we employ a variational auto-encoder (VAE) to generate synthetic data using a limited input dataset. Additionally, we propose a contrastive learning strategy to disentangle identity-related features from behavior/position-related features, enhancing the system's resilience to various use scenarios. Evaluation results demonstrate that Amulet achieves high authentication accuracy with a low false positive rate, while maintaining strong robustness against diverse attack vectors.