to, for example, change email passwords and, if necessary,
contact the cellular provider to block the SIM (Subscriber
Identity Module). In certain situations it might take a long
time from the moment the device is lost until the user reports
it. This would give a potential attacker plenty of time
to compromise the device.
Cellular infrastructures need to provide means of networkbased
misuse detection independent - yet transparent - from
the user that do not rely on any local computation or processing
on the device. For example, if a cell-phone is lost
or stolen at an airport prior to boarding a 14 hour intercontinental
flight, the network should be able to independently
detect and block any misbehavior originating from
the stranded device. And eventually block the terminal if appropriate.
Relying on the user reporting the incident would
give the attacker 14 hours of time to compromise the device.
In this paper we tackle the problem of non-intrusive identi-
fication of a user that legitimately interacted with the device
previously. In general there are several ways to identify a
device user based on: