  We introduce Hand Movement, Orientation, and Grasp (HMOG), a set of
behavioral features to continuously authenticate smartphone users. HMOG
features unobtrusively capture subtle micro-movement and orientation dynamics
resulting from how a user grasps, holds, and taps on the smartphone. We
evaluated authentication and biometric key generation (BKG) performance of HMOG
features on data collected from 100 subjects typing on a virtual keyboard. Data
was collected under two conditions: sitting and walking. We achieved
authentication EERs as low as 7.16% (walking) and 10.05% (sitting) when we
combined HMOG, tap, and keystroke features. We performed experiments to
investigate why HMOG features perform well during walking. Our results suggest
that this is due to the ability of HMOG features to capture distinctive body
movements caused by walking, in addition to the hand-movement dynamics from
taps. With BKG, we achieved EERs of 15.1% using HMOG combined with taps. In
comparison, BKG using tap, key hold, and swipe features had EERs between 25.7%
and 34.2%. We also analyzed the energy consumption of HMOG feature extraction
and computation. Our analysis shows that HMOG features extracted at 16Hz sensor
sampling rate incurred a minor overhead of 7.9% without sacrificing
authentication accuracy. Two points distinguish our work from current
literature: 1) we present the results of a comprehensive evaluation of three
types of features (HMOG, keystroke, and tap) and their combinations under the
same experimental conditions, and 2) we analyze the features from three
perspectives (authentication, BKG, and energy consumption on smartphones).
