Touchscreen mobile devices are becoming commodities as the wide adoption of pervasive computing. These devices allow users to access various services at anytime and anywhere. In order to prevent unauthorized access to these services, passwords have been pervasively used in user authentication. However, password-based authentication has intrinsic weakness in password leakage. This threat could be more serious on mobile devices, as mobile devices are widely used in public places.Most prior research on improving leakage resilience of password entry focuses on desktop computers, where specific restrictions on mobile devices such as small screen size are usually not addressed. Meanwhile, additional features of mobile devices such as touch screen are not utilized, as they are not available in the traditional settings with only physical keyboard and mouse. In this paper, we propose a user authentication scheme named CoverPad for password entry on touchscreen mobile devices. CoverPad improves leakage resilience by safely delivering hidden messages, which break the correlation between the underlying password and the interaction information observable to an adversary. It is also designed to retain most benefits of legacy passwords, which is critical to a scheme intended for practical use. The usability of CoverPad is evaluated with an extended user study which includes additional test conditions related to time pressure, distraction, and mental workload. These test conditions simulate common situations for a password entry scheme used on a daily basis, which have not been evaluated in the prior literature. The results of our user study show the impacts of these test conditions on user performance as well as the practicability of the proposed scheme.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=2943&context=sis_research

Designing leakage-resilient password entry on touchscreen mobile devices

It is intended to achieve a user authentication system capable of forcibly presenting a content to a user. Provided is a content presentation-type authentication system designed to allow a client to perform a content presentation-type user authentication in which user authentication is performed in such a manner that a plurality of pattern elements arranged in a given pattern are presented as a presentation pattern to a user who intends to be authenticated, and a one-time password derivation rule is used as a password of the user and applied to certain ones of the pattern elements located at specific positions in the presentation pattern to create a one-time password, and a content is forcibly presented to the user in connection with the user authentication. The content presentation-type authentication system comprises an authentication-service providing server configured to manage respective user IDs and passwords of users, content data indicative of a detail of each of a plurality of contents, and respective content IDs of the plurality of contents, and provide content-added authentication information to each of the users, and a client having a content presentation-type user authentication program and a processor.

Content presentation-type authentication system

Provided is a two-actor user authentication system with a reduced risk of leakage of authentication information The two-factor user authentication system is designed to use, as a password, a one-time-password derivation rule to be applied to certain pattern elements included in a presentation pattern at specific positions so as to create a one-time password, and further use, as a second authentication factor, information identifying a client to be used by a user An authentication server is operable to generate a pattern seed value adapted to uniquely specify a presentation pattern in combination with a client ID, and transmit the pattern seed value to an authentication-requesting client The authentication-requesting client is operable to create a presentation pattern based on a client ID acquired therefrom, and display the presentation pattern to allow a user to enter thereinto a one-time password based on the presentation pattern

System and method for two-factor user authentication

In traditional computing system, user Authentication is dependent on four authentication factors i.e., Something You have (e.g., a hardware token/credit card), Something You are (e.g., a fingerprint), and Something You know (e.g., a password/PIN code) and Somebody You know. In this paper we explore new factor of Authentication, that is, Something You process. Valid user identification is the demand of computing society and it plays a very key role in the arena of security. This study explores a new factor of authentication, human cognitive level of authentication for access control, and proposes new model of multilevel security. This study explores its usage in providing primary mode of authentication in a new and simplified way and discusses its pros and cons.

New Factor of Authentication: Something You Process

With the boom of Augmented Reality (AR) and Virtual Reality (VR) applications, head-mounted smart wearable glass devices are becoming popular to help users access various services like E-mail freely. However, most existing password entry schemes on smart glasses rely on additional computers or mobile devices connected to smart glasses, which require users to switch between different systems and devices. This may greatly lower the practicability and usability of smart glasses. In this paper, we focus on this challenge and design three practical anti-eavesdropping password entry schemes on stand-alone smart glasses, named gTapper, gRotator and gTalker. The main idea is to break the correlation between the underlying password and the interaction observable to adversaries. In our IRB-approved user study, these schemes are found to be easy-to-use without additional hardware under various test conditions, where the participants can enter their passwords within moderate time, at high accuracy, and in various situations.

/pdf/designing-leakage-resilient-password-entry-on-head-mounted-3owmj7gwyb.pdf

Designing Leakage-Resilient Password Entry on Head-Mounted Smart Wearable Glass Devices

An object of the present invention is to provide a matrix authentication system that reduces the risk of password leakage. A presenting the presentation pattern to a user to be authenticated, a user authentication system for password rules to generate the one-time password by applying the elements of the particular position it contains, the authentication server sends the presentation pattern in combination with the user ID to the authentication requesting client to generate a pattern seed value is a value determined uniquely, the authentication requesting client is in a pattern seed value with the received user ID inputted based on, to generate and display presentation pattern by a predetermined pattern element sequence generation rules, accepts an input of the one-time password from the user and transmitted to the authentication server, the authentication server generates the verification code to reproduce the presentation pattern and, at the same performs user authentication by comparing the one-time password. .The

User authentication system, and method

PROBLEM TO BE SOLVED: To provide a matrix authentication system for reducing the risk of password leakage SOLUTION: In this user authentication system for presenting a presentation pattern to a user who is authenticated, and for using a rule to be applied to the element of a specific position included in the presentation pattern for generating a one-time password as a password, an authentication server generates a pattern seed value as a value for uniquely determining the presentation pattern by combining it with user ID, and transmits it to an authentication request client, and the authentication request client generates and displays the presentation pattern according to a predetermined pattern element column generation rule based on the input user ID and the received pattern seed value, and accepts the input of the one-time password from the user, and transmits it to the authentication server, and the authentication server generates a verification code by reproducing the presentation pattern, and compares it with the one-time password for executing user authentication COPYRIGHT: (C)2008,JPO&INPIT

User authentication system and its method

PROBLEM TO BE SOLVED: To attain off-line matrix authentication with security. SOLUTION: In the user authentication system in which a presentation pattern is presented to a user to be authenticated, and a derivation rule for generating a one-time password by applying it to an element of a specific position contained in the pattern is used as a password, an off-line authentication client stores a plurality of pattern element strings constituting presentation patterns and a plurality of verification codes obtained by executing one-way function operation to application results of the derivation rule to the respective presentation patterns. The authentication is executed by generating the presentation pattern by selecting one of the stored pattern element strings and verifying the input one-time password based on a verification code corresponding thereto. COPYRIGHT: (C)2008,JPO&INPIT

幸哉上田

Papers

User authentication system, and method

User authentication system and its method

Off-line user authentication system, method and program

幸哉 上田

Papers

User authentication system, and method

User authentication system and its method

Off-line user authentication system, method and program

幸哉上田