Securing PIN‐based authentication in smartwatches with just two gestures

Abstract

Summary Smartwatches are becoming increasingly ubiquitous as they offer new capabilities to develop sophisticated applications that make daily life easier and more convenient for consumers. The services provided include applications for mobile payment, ticketing, identification, access control, etc. While this makes modern smartwatches very powerful devices, it also makes them very attractive targets for attackers. Indeed, PINs and Pattern Lock have been widely used in smartwatches for user authentication. However, such authentication methods are not robust against various forms of cybersecurity attacks, such as side channel, phishing, smudge, shoulder surfing, and video‐recording attacks. Moreover, the recent adoption of hardware‐based solutions, like the Trusted Execution Environment (TEE), can mitigate only partially such problems. Thus, the user's security and privacy are at risk without a strong authentication scheme in place. In this work, we propose 2GesturePIN, a new authentication framework that allows users to authenticate securely to their smartwatches and related sensitive services through solely two gestures. 2GesturePIN leverages the rotating bezel or crown, which are the most intuitive ways to interact with a smartwatch, as a dedicated hardware. 2GesturePIN improves the resilience of the regular PIN authentication method against state‐of‐the‐art cybersecurity attacks while maintaining a high level of usability.

Gotta CAPTCHA 'Em All: A Survey of Twenty years of the Human-or-Computer Dilemma

“…In [60], [63], authors proposed a PIN-based authentication method for smartwatches that embeds a form of physical CAPTCHA. This mechanism uses the same principle behind CAPPCHA [56].…”

“…For instance, behavioralbased CAPTCHA schemes strongly rely on mouse dynamics or on touch-and-tap dynamics, hence they require form-factor specialization. Sensor-based CAPTCHA schemes require sensors that are available only in tablets, smartphones and smartwatches (e.g., [60], [62]), hence they are currently unavailable on a large portion of users' devices and further study to find potential surrogates of sensors data, possibly relying on trusted hardware, on desktops and laptops are needed.…”

PatternMonitor: a whole pipeline with a much higher level of automation for guessing Android lock pattern based on videos

“…5m/8m), an adversary can also collects enough information to implement the cracking procedure. In addition, the increasing types of wearable device [20,23,36] make this attack more convenient and unperceivable.…”

A New Security Solution Enhancing the Dynamic Array PIN Protocol

“…Unfortunately, an attacker is able to remotely steal the banking data stored in an NFC bank card or an NFC smartphone, without the knowledge of the client [6]. In addition, the user's password or the Personal Identification Number (PIN) can be stolen through various attacks such as: spyware [7], shoulder-surfing [8], side channel [9], brute force [10], replay [11], smudge [12], camera recording [13], video recording [14] and multiple registration [15]. Indeed, in order to deposit or withdraw money using an NFC smartphone in front of an ATM, the user must authenticate himself.…”