Security Notions and Advanced Method for Human Shoulder-Surfing Resistant PIN-Entry

Lee, Mun-Kyu

doi:10.1109/tifs.2014.2307671

Cited by 61 publications

(31 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…the OA model (this attack is often also called a Shoulder Surfing Attack), several authentication methods are proposed in the literature. Lee proposed in [17] a method using n rounds for a code composed of n digits. The screen displays two horizontal arrays, one composed of digits on the other composed of symbols.…”

Section: B Related Workmentioning

confidence: 99%

Security analysis and psychological study of authentication methods with PIN codes

Bultel

Dreier

Giraud

et al. 2018

2018 12th International Conference on Research Challenges in Information Science (RCIS)

View full text Add to dashboard Cite

Index Terms-security, authentication, pin code Abstract-Touch screens have become ubiquitous in the past few years, like for instance in smartphones and tablets. These devices are often the entry door to numerous information systems, hence having a secure and practical authentication mechanism is crucial. In this paper, we examine the complexity of different authentication methods specifically designed for such devices.We study the widely spread technology to authenticate a user using a Personal Identifier Number code (PIN code). Entering the code is a critical moment where there are several possibilities for an attacker to discover the secret. We consider the three attack models: a Bruteforce Attack (BA) model , a Smudge Attack (SA) model, and an Observation Attack (OA) model where the attacker sees the user logging in on his device. The aim of the intruder is to learn the secret code.Our goal is to propose alternative methods to enter a PIN code. We compare such different methods in terms of security. Some methods require more intentional resources than other, this is why we performed a psychological study on the different methods to evaluate the users' perception of the different methods and their usage.

show abstract

Section: B Related Workmentioning

confidence: 99%

Security analysis and psychological study of authentication methods with PIN codes

Bultel

Dreier

Giraud

et al. 2018

2018 12th International Conference on Research Challenges in Information Science (RCIS)

View full text Add to dashboard Cite

show abstract

“…Another issue with a nonstandard PIN is that it is not compatible with existing systems [8]. If the new PIN-entry method is supposed to be used for limited purposes, for example, to unlock a smartphone, defining a new PIN space such as in Timelock is not a problem.…”

Section: Reduction Of Pin Space Sizementioning

confidence: 99%

“…Recently, it was discovered that the binary method is actually vulnerable to well-trained human attackers, and PIN-entry methods that are more resistant to such attacks have been proposed [8,9]. The design goal of these methods as well as the binary method is to prevent an observation attack by a human observer who does not use a recording device, and thus such countermeasures are suitable for the few situations in which an attacker cannot use a recording device such as a phone camera [8].…”

Section: Introductionmentioning

confidence: 99%

“…The design goal of these methods as well as the binary method is to prevent an observation attack by a human observer who does not use a recording device, and thus such countermeasures are suitable for the few situations in which an attacker cannot use a recording device such as a phone camera [8]. In contrast, the above methods cannot protect a PIN if an attacker can gather challenge-response pairs using a hidden recording device without being detected and s/he can perform an offline analysis on the obtained data.…”

Section: Introductionmentioning

confidence: 99%

“…Therefore, a PIN-entry method with recording resilience is required. However, it was proved in [8] that the resistance to recording attacks can only be achieved by sacrificing the resistance to random guessing attacks if the challenge-response pairs are observable. In other words, if a PIN-entry method is designed to be secure against recording attacks, the attacker's chance of successful log-on by entering a random PIN is increased, which causes another kind of problem.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Analysis and Improvement on a Unimodal Haptic PIN-Entry Method

Lee

Yoo

Nam³

2017

Mobile Information Systems

Self Cite

View full text Add to dashboard Cite

User authentication is a process in which a user of a system proves his/her identity to acquire access permission. An effective user authentication method should be both secure and usable. In an attempt to achieve these two objectives, Bianchi et al. recently proposed novel unimodal PIN-entry methods that use either audio or vibration cues. This paper analyzes the security of their method, in particular, the vibration version of one of their proposals, Timelock. A probabilistic analysis and real attack experiment reveal that the security level guaranteed by Timelock is lower than that claimed in Bianchi et al. 's paper. As countermeasures to this problem, three PIN-entry methods are proposed and a usability study is performed. According to the result of this study, a simple modification may improve the security significantly while retaining the design philosophy of unimodal systems. In addition, the proposed methods address the PIN compatibility issue of Timelock and they can be used to enter a legacy numerical PIN without any change in the PIN.

show abstract

SGP: A Safe Graphical Password System Resisting Shoulder-Surfing Attack on Smartphones

Panda

Kumari

Mondal

2018

Information Systems Security

View full text Add to dashboard Cite

Security Notions and Advanced Method for Human Shoulder-Surfing Resistant PIN-Entry

Cited by 61 publications

References 23 publications

Security analysis and psychological study of authentication methods with PIN codes

Security analysis and psychological study of authentication methods with PIN codes

Analysis and Improvement on a Unimodal Haptic PIN-Entry Method

SGP: A Safe Graphical Password System Resisting Shoulder-Surfing Attack on Smartphones

Contact Info

Product

Resources

About