The unprecedented rise of IoT has revolutionized every business vertical enthralling people to embrace IoT applications in their day-to-day lives to accrue multifaceted benefits. It is absolutely fair to say that a day without connected IoT systems, such as smart devices, smart enterprises, smart homes or offices, etc., would hamper our conveniences, drastically. Many IoT applications for these connected systems are safety-critical, and any unauthorized access could have severe consequences to their consumers and society. In the overall IoT security spectrum, human-to-machine authentication for IoT applications is a critical and foremost challenge owing to highly prescriptive characteristics of conventional user authentication schemes, i.e., knowledge-based or token-based authentication schemes, currently used in them. Furthermore, studies have reported numerous users’ concerns, from both the security and usability perspectives, that users are facing in using available authentication schemes for IoT applications. Therefore, an impetus is required to upgrade user authentication schemes for new IoT age applications to address any unforeseen incidents or unintended consequences. This dissertation aims at designing next-generation user authentication schemes for IoT applications to secure connected systems, namely, smart devices, smart enterprises, smart homes, or offices. To accomplish my research objectives, I perform a thorough study of ways and types of user authentication mechanisms emphasizing their security and usability ramifications. Subsequently, based on the substantive findings of my studies, I design, prototype, and validate our proposed user authentication schemes. I exploit both physiological and behavioral biometrics to design novel schemes that provide implicit (frictionless), continuous (active) or risk-based (non-static) authentication for multi-user scenarios. Afterward, I present a comparative analysis of the proposed schemes in terms of accuracy against the available state-of-the-art user authentication solutions. Also, I conduct SUS surveys to evaluate the usability of user authentication schemes.

In today's globally expanding business world, protecting the identity and transactions of online consumers is crucial for any company to reach out for new markets. This directs digital information technologies towards the adoption of stronger and more secure authentication schemes. Increasingly, such biometric-based user authentication systems have proven superiority over the traditional ones (such as username/password). Unfortunately, despite the significant advances accomplished in developing biometric technologies, there are several barriers to their wide-scale deployment and application for Internet security. Additionally, introducing new biometrics faces similar barriers and challenges such as expensive equipment, or low-precision sensor technologies. In this research, we propose a novel biometric system for static user authentication, that homogeneously combines mouse dynamics, visual search capability and short-term memory effect. The proposed system introduces the visual search capability, and short-term memory effect to the biometric-based security world for the first time. The use of mouse for its dynamics, and as an input sensor for the other two biometrics, means no additional hardware is required. Experimental evaluation demonstrated the system's effectiveness using variable or one-time passwords. All of these attributes qualify the proposed system to be effectively deployed as a static Web-authentication mechanism. Extensive experimentation was done using 2740 sessions collected from 274 users. Two classification mechanisms were used to measure the performance. Using the first of these, a specially devised neural network model called Divide & Select, an EER of 5.7% was achieved. A computational statistics model showed a higher classification performance; a statistical classifier design called Weighted-Sum produced an EER of 2.1%. The performance enhancement produced as a result of changing the analysis model suggests that with further analysis, performance could be enhanced to an industry standard level. Additionally, we presented a Proof of Concept (POC) system to show the system packaging practicality.