Currently, the most prevalent approaches to authenticate smartphones involve either PINs, swipe patterns, or passwords. Few users enable these approaches. In order to encourage adoption, new authentication methods are needed. Emerging methods rely on the distinctness of a user's touch-based gesture for continuous authentication, providing an unobtrusive approach that simply monitors swipes and other input gestures as they are performed in the context of everyday smartphone use. However, existing methods do not consider the distinctness of a user's touch when different fingers are used. In this paper, we present the results of a small pilot study that suggests that a touch-based gesture performed by the same user with a different finger is indeed distinct. We present an approach that uses accelerometer data to identify the position of the phone and the finger that is being used in a touch-based gesture. Our results suggest that touch-based continuous authentication accuracies can be improved by considering accelerometer data and an individual's various fingers.

At Your Fingertips: Considering Finger Distinctness in Continuous Touch-Based Authentication for Mobile Devices

In this paper, a new scheme that uses digraph substitution rules to conceal the mechanism or activity required to derive password-images is proposed. In the proposed method, a user is only required to click on one of the pass-image instead of both pass-images shown in each challenge set for three consecutive sets.While this activity is simple enough to reduce login time, the images clicked appear to be random and can only be obtained with complete knowledge of the registered password along with the activity rules. Thus, it becomes impossible for shoulder-surfing attackers to obtain the information about which password images and pass-images are used by the user. Although the attackers may know about the digraph substitution rules used in the proposed method, the scenario information used in each challenge set remains. User study results reveal an average login process of less than half a minute. In addition, the proposed method is resistant to shoulder-surfing attacks.

Graphical password: prevent shoulder-surfing attack using digraph substitution rules

Traditional password-based authentication schemes are vulnerable to shoulder-surfing attacks. Attackers may steal user's sensitive information through direct observation, particularly at crowded places. In this paper, we propose a novel mobile authentication mechanism to prevent shoulder-surfing attacks. Even though an attacker can capture a user's input, he cannot derive the original password from his observation. Our authentication mechanism can be applied in various systems, especially on mobile devices. In the security analysis section, we prove that our scheme is secure against shoulder-surfing attacks, phishing attacks, and other malicious software attacks.

A mobile authentication system resists to shoulder-surfing attacks

Considering the popularity and wide deployment of text passwords, we predict that they will be used as a prevalent authentication mechanism for many years to come. Thus, we have carried out studies on mechanisms to enhance text passwords. These studies suggest that password space and memorability should be improved, with an additional mechanism based on images. The combination of text and images increases resistance to some password attacks, such as brute force and observing attacks. We propose a hybrid authentication scheme integrating text and recognition-based graphical passwords. This authentication scheme can reduce the phishing attacks because if users are deceived to share their key passwords, there is still a chance to save the complete password as attackers do not know the users’ image preferences. In addition to the security aspect, the proposed authentication scheme increases memorability as it does not require users to remember long and complex passwords. Thus, with the proposed scheme users will be able to create strong passwords without sacrificing usability. The hybrid scheme also offers an enjoyable sign-in/log-in experience to users.

/pdf/a-novel-hybrid-password-authentication-scheme-based-on-text-2weyjcovns.pdf

A Novel Hybrid Password Authentication Scheme Based on Text and Image

Graphical password is an alternative authentication mechanism in order to access to the system. As a matter of fact, it is more secure than the textual passwords, but it is vulnerable to shoulder-surfing attack. In this paper, we propose a new method which is resistant to shoulder-surfing attack by using a false image in authentication step. As a result, it will be a complex task for a hacker to capture and misuse the password, due to the usage of false image.

Graphical password: Shoulder-surfing resistant using falsification

Since conventional password schemes are vulnerable to shoulder surfing, many shoulder surfing resistant graphical password schemes have been proposed However, as most users are more familiar with textual passwords than pure graphical passwords, text-based graphical password schemes have been proposed Unfortunately, none of existing text-based shoulder surfing resistant graphical password schemes is both secure and efficient enough In this paper, we propose an improved text-based shoulder surfing resistant graphical password scheme by using colors In the proposed scheme, the user can easily and efficiently login system Next, we analyze the security and usability of the proposed scheme, and show the resistance of the proposed scheme to shoulder surfing and accidental login

A simple text-based shoulder surfing resistant graphical password scheme

Since the eavesdropping resistant remote password authentication schemes based on cryptography require that certain cryptosystems and/or cryptographic hash functions have to be implemented in the user's login device. Thus, many eavesdropping resistant remote password authentication schemes without using cryptography have been proposed. However, most existing eavesdropping resistant remote password authentication schemes without using cryptography are time-consuming, hard to learn, difficult to use, and/or difficult to implement. Recently, Yeh et al. have proposed a simple and efficient eavesdropping resistant remote password authentication scheme without using cryptography, ColorPallete. Unfortunately, the resistance of ColorPallete to eavesdropping is unsatisfactory. In this paper, we propose an enhanced version of ColorPallete. The eavesdropping resistance and the password space of the proposed scheme are superior to the ones of ColorPallete while the resistance to accidental login is kept unchanged at the cost of additionally memorizing one pass-icon.

Yu-Chang Yeh

Papers

A simple text-based shoulder surfing resistant graphical password scheme

An enhanced simple secure remote password authentication scheme without using cryptography