Evaluation of eye-gaze interaction methods for security enhanced PIN-entry

Abstract

Personal identification numbers (PINs) are one of the most common ways of electronic authentication these days and used in a wide variety of applications, especially in ATMs (cash machines). A non-marginal amount of tricks are used by criminals to spy on these numbers to gain access to the owners' valuables. Simply looking over the victims' shoulders to get in possession of their PINs is a common one. This effortless but effective trick is known as shoulder surfing. Thus, a less observable PIN entry method is desirable. In this work, we evaluate three different eye gaze interaction methods for PINentry, all resistant against these common attacks and thus providing enhanced security. Besides the classical eye input methods we also investigate a new approach of gaze gestures and compare it to the well known classical gaze-interactions. The evaluation considers both security and usability aspects. Finally we discuss possible enhancements for gaze gestures towards pattern based identification instead of number sequences.

Shoulder surfing defence for recall-based graphical passwords

“…For example, researchers in [12,4] attempted to use similar gazing-based technique as in [7] to enter sensitive input from an on-screen keyboard. The evaluation of EyePIN in [4] showed promise, but it also seems to have revealed some usability problems when users needed to remember and understand the new alphabet gestures in order to use them. Also, additional hardware costs for eye tracking equipment are needed for this type of approaches.…”

“…For example: the sequence Pen-up, (1,2), (1,3), (1,4), Pen-up defines a stroke: (1,2), (1,3), (1,4). The length of a stroke is the number of coordinate pairs it contains.…”

An Ancient Indian Board Game as a Tool for Authentication

“…Luca et al [15] evaluated different authentication techniques for ATM usage. During the experimentations they found that many users tend to support their memory for their 4-digit-PINs by incorporating the layout of the digits on the number pad and the shape resulting from these spatial relations.…”

Towards task-independent person authentication using eye movement signals

“…The currently adopted approaches consider eye gaze as an alternative way to input user-specific PIN numbers or passwords; see [Kumar et al 2007] for a recent review of such methods. In these systems, the user may input the pass-phrase by, for instance, gazetyping the password [Kumar et al 2007], using graphical passwords such as human faces [Passfaces ], or using gaze gestures similar to mouse gestures in web browsers [Luca et al 2007]. In such systems, it is important to design the user interface (presenting the keypad or visual tokens; providing user feedback) to find acceptable trade-off between security and usability -too complicated cognitive task becomes easily distracting.…”