Security analysis and psychological study of authentication methods with PIN codes

Abstract

Index Terms-security, authentication, pin code Abstract-Touch screens have become ubiquitous in the past few years, like for instance in smartphones and tablets. These devices are often the entry door to numerous information systems, hence having a secure and practical authentication mechanism is crucial. In this paper, we examine the complexity of different authentication methods specifically designed for such devices.We study the widely spread technology to authenticate a user using a Personal Identifier Number code (PIN code). Entering the code is a critical moment where there are several possibilities for an attacker to discover the secret. We consider the three attack models: a Bruteforce Attack (BA) model , a Smudge Attack (SA) model, and an Observation Attack (OA) model where the attacker sees the user logging in on his device. The aim of the intruder is to learn the secret code.Our goal is to propose alternative methods to enter a PIN code. We compare such different methods in terms of security. Some methods require more intentional resources than other, this is why we performed a psychological study on the different methods to evaluate the users' perception of the different methods and their usage.

A User Authentication Enabled Piezoelectric Force Touch System for the Internet of Things

“…INTRODUCTION With the rapid rise in use of mobile devices, access security is becoming a global concern. As the most widely used and accepted method, password-based identity authentication [1] has many security loopholes, such as brute force cracking and smudge attacks [2]. Keystroke authentication can be a good alternative as it not only solves the insecurity of passwords but also has other advantages, such as low cost, high flexibility, and simpler hardware structure as compared to other biometric authentication methods [3][4][5], such as fingerprint and face identification.…”

User-Device Authentication in Mobile Banking Using APHEN for Paratuck2 Tensor Decomposition

“…In [6], the authors developed the idea that public-key infrastructure based systems, such as strong passwords in combination with physical tokens, for example, a cell phone, would be more likely to be used and largely deployed. Nonetheless, it is worth mentioning that the most common procedure for mobile devices authentication is still a code of four or six digits [7].…”

“…Since the gradient and the Hessian matrix are computed with finite differences, the only prerequisite for Paratuck2 tensor decomposition is the factorization equation (7). Thus, the method can be transposed to other decompositions, such as CP, by merely changing the tensor decomposition equation.…”

Two-Factor Authentication Scheme for Mobile Money: A Review of Threat Models and Countermeasures

“…For user convenience, PINs are often short (up to eight digits) to allow access to only authorised users. PINs are widely used for user authentication such as withdrawing cash from mobile money or withdrawing money from an automated teller machine (ATM) [84]. Mtaho [52], Islam [85], Ombiro [86], Singh and Jasmine [87], Fan et al [88], Islam et al [89], and Zadeh and Barati [90] employed authentication schemes using PINs to verify user identity.…”

“…The PIN should be easy to remember, random, and hard to guess, while it should be changed frequently, distinct for different accounts, and not written down or stored in plaintext [52]. However, using a PIN in mobile money authentication is susceptible to shoulder surfing attacks, brute force attacks, and smudge attacks [83,84,91]. • OTP: Elganzoury, Abdelhafez, and Hegazy [92] defined OTP as a unique and time-sensitive string of alphanumeric characters generated and forwarded to the user's mobile phone via either email or SMS for a single authentication session.…”