Password Entry Research Articles

Mimicry Attacks on Smartphone Keystroke Authentication

Keystroke behaviour-based authentication employs the unique typing behaviour of users to authenticate them. Recent such proposals for virtual keyboards on smartphones employ diverse temporal, contact, and spatial features to achieve over 95% accuracy. Consequently, they have been suggested as a second line of defense with text-based password authentication. We show that a state-of-the-art keystroke behaviour-based authentication scheme is highly vulnerable against mimicry attacks. While previous research used training interfaces to attack physical keyboards, we show that this approach has limited effectiveness against virtual keyboards. This is mainly due to the large number of diverse features that the attacker needs to mimic for virtual keyboards. We address this challenge by developing an augmented reality-based app that resides on the attacker’s smartphone and leverages computer vision and keystroke data to provide real-time guidance during password entry on the victim’s phone. In addition, we propose an audiovisual attack in which the attacker overlays transparent film printed with spatial pointers on the victim’s device and uses audio cues to match the temporal behaviour of the victim. Both attacks require neither tampering or installing software on the victim’s device nor specialized hardware. We conduct experiments with 30 users to mount over 400 mimicry attacks. We show that our methods enable an attacker to mimic keystroke behaviour on virtual keyboards with little effort. We also demonstrate the extensibility of our augmented reality-based technique by successfully mounting mimicry attacks on a swiping behaviour-based continuous authentication system.

Stealing Passwords by Observing Hands Movement

The use of mobile phones in public places opens up the possibilities of remote side channel attacks on these devices. We present a video-based side channel attack to decipher passwords on mobile devices. Our method uses short video clips ranging from 5 to 10 s each, which can be taken unobtrusively from a distance and do not require the keyboard or the screen of the phone to be visible. By relating the spatiotemporal movements of the user’s hand during typing and an anchor point on any visible part of the phone, we predict the typed password with high accuracy. The results on a dataset of 375 short videos of password entry process on a Samsung Galaxy S4 phone show an exponential reduction in the search space compared to a random guess. For each key-press corresponding to a character in the passwords, our method was able to reduce the search space to an average of 2–3 keys compared to ~30 keys if one has to guess the key randomly. Thus, this paper reaffirms threats to smartphone users’ conventional login in public places and highlights the threats in scenarios such as hiding the screen that otherwise gives the impression of being safe to the users.

CORMORANT

People own and carry an increasing number of ubiquitous mobile devices, such as smartphones, tablets, and notebooks. Being small and mobile, those devices have a high propensity to become lost or stolen. Since mobile devices provide access to their owners' digital lives, strong authentication is vital to protect sensitive information and services against unauthorized access. However, at least one in three devices is unprotected, with inconvenience of traditional authentication being the paramount reason. We present the concept of CORMORANT, an approach to significantly reduce the manual burden of mobile user verification through risk-aware, multi-modal biometric, cross-device authentication. Transparent behavioral and physiological biometrics like gait, voice, face, and keystroke dynamics are used to continuously evaluate the user's identity without explicit interaction. The required level of confidence in the user's identity is dynamically adjusted based on the risk of unauthorized access derived from signals like location, time of day and nearby devices. Authentication results are shared securely with trusted devices to facilitate cross-device authentication for co-located devices. Conducting a large-scale agent-based simulation of 4 000 users based on more than 720 000 days of real-world device usage traces and 6.7 million simulated robberies and thefts sourced from police reports, we found the proposed approach is able to reduce the frequency of password entries required on smartphones by 97.82% whilst simultaneously reducing the risk of unauthorized access in the event of a crime by 97.72%, compared to conventional knowledge-based authentication.

ReconViguRation: Reconfiguring Physical Keyboards in Virtual Reality

Physical keyboards are common peripherals for personal computers and are efficient standard text entry devices. Recent research has investigated how physical keyboards can be used in immersive head-mounted display-based Virtual Reality (VR). So far, the physical layout of keyboards has typically been transplanted into VR for replicating typing experiences in a standard desktop environment. In this paper, we explore how to fully leverage the immersiveness of VR to change the input and output characteristics of physical keyboard interaction within a VR environment. This allows individual physical keys to be reconfigured to the same or different actions and visual output to be distributed in various ways across the VR representation of the keyboard. We explore a set of input and output mappings for reconfiguring the virtual presentation of physical keyboards and probe the resulting design space by specifically designing, implementing and evaluating nine VR-relevant applications: emojis, languages and special characters, application shortcuts, virtual text processing macros, a window manager, a photo browser, a whack-a-mole game, secure password entry and a virtual touch bar. We investigate the feasibility of the applications in a user study with 20 participants and find that, among other things, they are usable in VR. We discuss the limitations and possibilities of remapping the input and output characteristics of physical keyboards in VR based on empirical findings and analysis and suggest future research directions in this area.

도시형생활주택의 물리적 현황과 1인 가구 특성이 주택 내 범죄불안감에 미치는 영향 분석 : 서울시 원룸형 주택을 중심으로

Purpose: The purpose of this study is to identify the physical state of a house and characteristics of its residents targeting at one-room type house in urban-type housing, which is a typical housing type for single-person households, and to analyze whether the two factors affect the fear of crime in housing for single-person households. Method: The research method conducted a survey of single-person households living in urban-type housing and utilized 170 effective copies for data analysis. Data were analyzed through SPSS 23.0 Statistical Program and a fear of crime survey scale was investigated by a five-point Likert scale. The survey contents included social and demographic characteristics of residents, housing characteristics, physical state of houses, and fear of crime in each space. Result: In summary, male had more characteristics of a single-person living in a one-room house than female and the proportion of people in their 20s was high. They also preferred small-sized house and chose traffic environment as an important factor in selecting a house. As the physical state of one-room housing, more than 80% of the lighting was installed for frequently used spaces by residents while spaces used by some residents such as rooftop and parking lot had poor lighting installations. Different ages and occupations showed different levels of space utilization and fear of crime, and it is deemed that CPTED plan should be applied by considering the degree of utilization of space and time of returning home. In case of the space in front of elevators on first floor and inside the elevators, there was less fear of crime in houses with corridors than houses without corridors. Finally, in case of building door control system at night, the password entry system had higher fear of crime than other entry systems.

Microcontroller Based Electronic Digital Lock with Security Notification

Due to the advancement in science and technology all over the world, there is a significant increase in the rate of crime and sophistication in crimes; as a result, it is necessary to ensure the security of one’s self and one’s valuable belongings. The main goal of this paper is aimed at creating an electronic security system capable of detecting an intruder and reporting to security personnel. The design of the microcontroller based electronic digital lock with security notification uses a four-digit pass key for its operation. The operation involves opening the door, closing the door, changing of password and alarm upon wrong password entry. It is important for use in Bank Vaults, Hotels, Offices and can also be used in our homes. The research objectives were achieved with the use of microcontroller which programs the ATMEGA328P microprocessor and interfaces it with all the other components in the circuit. In the end, the circuit was able to activate the relay switches for opening and closing the door in about three seconds, and the alarm sounds when it detects a wrong password. Comparison was made between the conventional traditional lock system and the proposed one. The distinctive feature added is the sliding door, the security notification feature and the password modification in case of a breach in security. The design fulfills the requirements of supporting conventional lock systems eliminating the use of ordinary keys shared among occupants. To demonstrate and evaluate the design, a prototype was developed. As compared to other microcontroller based digital lock, it is easy and it required less hardware. It doesn’t need additional A/D and D/A converter. We can set the password and reset it without using external device and can be easily implemented. The evaluation shows that the design works well, consumes minimal power and is able to unlock a door.Atmega328p Microcontroller was used as the main component of the project.

Linux memory forensics: Dissecting the user space process heap

The analysis of memory during a forensic investigation is often an important step to reconstruct events. While prior work in this field has mostly concentrated on information residing in the kernel space (process lists, network connections, and so on) and in particular on the Microsoft Windows operating system, this work focuses on Linux user space processes as they might also contain valuable information for an investigation. Because a lot of process data is located in the heap, this work in the first place concentrates on the analysis of Glibc's heap implementation and on how and where heap related information is stored in the virtual memory of Linux processes that use this implementation. Up to now, the heap was mostly considered a large cohesive memory region from a memory forensics perspective, making it rather hard manual work to identify relevant information inside. We introduce a Python class for the memory analysis framework Rekall that is based on our analysis results and allows access to all chunks contained in the heap and their meta information. Further, based on this class, six plugins have been developed that support an investigator in analyzing user space processes: Four of these plugins provide generic analysis capabilities such as finding information/references within chunks and dumping chunks into separate files for further investigation. These plugins have been used to reverse engineer data structures within the heap for user space processes, while illustrating how such plugins ease the whole analysis process. The remaining two plugins are a result of these user space process analyses and are extracting the command history for the zsh shell and password entry information for the password manager KeePassX.

The interplay between humans, technology and user authentication: A cognitive processing perspective

This paper investigates the interplay among human cognitive processing differences (field dependence vs. field independence), alternative interaction device types (desktop vs. touch) and user authentication schemes (textual vs. graphical) towards task completion efficiency and effectiveness. A four-month user study (N = 164) was performed under the light of the field dependence-independence theory which underpins human cognitive differences in visual perceptiveness as well as differences in handling contextual information in a holistic or analytic manner. Quantitative and qualitative analysis of results revealed that field independent (FI) users outperformed field dependent users (FD) in graphical authentication, FIs authenticated similarly well on desktop computers as on touch devices, while touch devices negatively affected textual password entry performance of FDs. Users' feedback from a post-study survey further showed that FD users had memorability issues with graphical authentication and perceived the added difficulty when interacting with textual passwords on touch devices, in contrast to FI users that did not have significant usability and memorability issues on both authentication and interaction device types. Findings highlight the necessity to improve current approaches of knowledge-based user authentication research by incorporating human cognitive factors in both design and run-time. Such an approach is also proposed in this paper.

Visible Light Identification System for Smart Door Lock Application with Small Area Outdoor Interface

Visible light identification (VLID) is a user identification system for a door lock application using smartphone that adopts visible light communication (VLC) technology with the objective of high security, small form factor, and cost effectiveness. The user is verified by the identification application program of a smartphone via fingerprint recognition or password entry. If the authentication succeeds, the corresponding encoded visible light signals are transmitted by a light emitting diode (LED) camera flash. Then, only a small size and low cost photodiode as an outdoor interface converts the light signal to the digital data along with a comparator, and runs the authentication process, and releases the lock. VLID can utilize powerful state-of-the-art hardware and software of smartphones. Furthermore, the door lock system is allowed to be easily upgraded with advanced technologies without its modification and replacement. It can be upgraded by just update the software of smartphone application or replacing the smartphone with the latest one. Additionally, wireless connection between a smartphone and a smart home hub is established automatically via Bluetooth for updating the password and controlling the home devices. In this paper, we demonstrate a prototype VLID door lock system that is built up with LEGO blocks, a photodiode, a comparator circuit, Bluetooth module, and FPGA board.

Password Entry Times for Recognition-based Graphical Passwords

Graphical passwords offer a more memorable alternative to traditional, text-based passwords. Among current contenders, cued-recall based click-point or gesture centered authentication systems like Microsoft’s picture gesture authentication (PGA) have been commercially more successful than recognition based systems (e.g., PassFaces). One perceived drawback of graphical authentication systems in general and especially recognition based authentication is the assumption that graphical authentication is slower and thus less user-friendly than traditional password entry via keyboard. This paper addresses these concerns and demonstrates a lower limit for recognition-based password entry times achievable with sufficient practice. While slightly slower than traditional keyboard based passwords, the entry speed of often-used graphical passwords is shown to reach 10 bits/s in an optimized configuration, which is sufficient for everyday use (3-6s per authentication sequence @ 36 bits) and exceeds the reported speed of similarly secure text-based passwords on non-traditional devices using virtual keyboards.

Memory and Motor Processes of Password Entry Error

Passwords are tightly interwoven with the digital fabric of our current society. Unfortunately, passwords that provide better security generally tend to be more complex, both in length and composition. Complex passwords are problematic both cognitively and motorically, leading to both memory and motor errors during recall and entry. It is important that we better understand and disentangle the two error sources, as password entry errors can have significant negative consequences, such as being locked out of a critical information system. We present a computational cognitive model of password recall and typing, with memory and motor errors each contributing to password entry error. With this synthesis we can study human-computer interaction issues involving the usability of computer access control systems, specifically the password as an authentication mechanism. Ultimately we hope to make science-based recommendations for password policies that promote the use of passwords that are more usable.

Feasibility of "CopeSmart": A Telemental Health App for Adolescents.

BackgroundEarly intervention is important in order to improve mental health outcomes for young people. Given the recent rise in mobile phone ownership among adolescents, an innovative means of delivering such intervention is through the use of mobile phone applications (apps).ObjectiveThe aim of this study was to evaluate the feasibility of “CopeSmart”, a telemental health app developed to foster positive mental health in adolescents through emotional self-monitoring and the promotion of positive coping strategies.MethodsForty-three adolescents (88% female) aged 15-17 years downloaded the app and used it over a one-week period. They then completed self-report questionnaires containing both open-ended and closed-ended questions about their experiences of using the app. The app itself captured data related to user engagement.ResultsOn average participants engaged with the app on 4 of the 7 days within the intervention period. Feedback from users was reasonably positive, with 70% of participants reporting that they would use the app again and 70% reporting that they would recommend it to a friend. Thematic analysis of qualitative data identified themes pertaining to users’ experiences of the app, which were both positive (eg, easy to use, attractive layout, emotional self-monitoring, helpful information, notifications, unique) and negative (eg, content issues, did not make user feel better, mood rating issues, password entry, interface issues, engagement issues, technical fixes).ConclusionsOverall findings suggest that telemental health apps have potential as a feasible medium for promoting positive mental health, with the majority of young people identifying such technologies as at least somewhat useful and displaying a moderate level of engagement with them. Future research should aim to evaluate the efficacy of such technologies as tools for improving mental health outcomes in young people.

A Novel Crave-Char Based Password Entry System Resistant to Shoulder-Surfing

A Novel Crave-Char Based Password Entry System Resistant to Shoulder-Surfing

Leakage-resilient password entry: Challenges, design, and evaluation

Password leakage is one of the most serious threats for password-based user authentication. Although this problem has been extensively investigated over the last two decades, there is still no widely adopted solution. In this paper, we attempt to systematically understand the challenges behind this problem and investigate the feasibility of solving it. Since password leakage usually happens when a password is input during authentication, we focus on designing leakage-resilient password entry (LRPE) schemes in this study. We develop a broad set of design criteria and use them to construct a practical LRPE scheme named CoverPad, which not only improves leakage resilience but also retains most usability benefits of legacy passwords. Its practicability is further verified by an extended user study.

Drag-and-type: a new method for typing with virtual keyboards on small touchscreens

Small touchscreens are widely used in consumer electronics, such as smartphones and mobile electronic devices. However, typing on the small touchscreen is still worth studying. In fact, smartphone users are experiencing difficulties and also many errors in typing alphanumeric keys with their thumbs because a small virtual keyboard even with the reduced set of touchable keys can only provide tiny size keys to the users. This paper studies a new style of typing method called Drag-and-Type, which leverages the dragging action instead of direct tapping on the touchscreen to ease more accurate typing on the small virtual keyboard. Although the typing speed is controversial, the consumers can choose this method when an accurate typing is more required, for example, for a password entry that is quite more sensitive to erroneous key inputs. In that sense, the proposed method is further explored to the extension called Secure Drag-and-Type for securing the password entry against shoulder-surfing and spyware attacks under the Dragand- Type paradigm. In the user study, it was found that the proposed method could be used for secure and accurate password entry on the small touchscreen regarding the securitysensitive consumer electronics applications.

Random Board: Password Authentication Method with Tolerance to Video-Recording Attacks

The user authentication is widely used in the automatic teller machines (ATMs) and many Internet services. Recently, the crimes that ATM passwords are stolen using a small charge-coupled device (CCD) cameras have increased. In addition, in the mobile environment, there is a high risk of observation attacks that steal passwords, because many people possess devices such that camera-equipped mobile phones and miniature cameras. In this paper, we propose the authentication methods that are secure against the brute-force and video recording attacks. In the article, a video-recording attack is defined as an attacker's analysis of videos, in which a user's password entry operations are recorded once or twice, in order to obtain the user's password. We propose a basic method and an improved method. In the basic method, a user must provide the correct entry position of each password beforehand. On the other hand, in the improved method, a user does not need to provide any information beforehand, other than the password. The relative security of the two proposed methods is then evaluated.

User Authentication Based on Representative Users

User authentication based on username and password is the most common means to enforce access control. This form of access restriction is prone to hacking since stolen usernames and passwords can be exploited to impersonate legitimate users in order to commit malicious activity. Biometric authentication incorporates additional user characteristics such as the manner by which the keyboard is used in order to identify users. We introduce a novel approach for user authentication based on the keystroke dynamics of the password entry. A classifier is tailored to each user and the novelty lies in the manner by which the training set is constructed. Specifically, only the keystroke dynamics of a small subset of users, which we refer to as representatives, is used along with the password entry keystroke dynamics of the examined user. The contribution of this approach is twofold: it reduces the possibility of overfitting, while allowing scalability to a high volume of users. We propose two strategies to construct the subset for each user. The first selects the users whose keystroke profiles govern the profiles of all the users, while the second strategy chooses the users whose profiles are the most similar to the profile of the user for whom the classifier is constructed. Results are promising reaching in some cases 90% area under the curve. In many cases, a higher number of representatives deteriorate the accuracy which may imply overfitting. An extensive evaluation was performed using a dataset containing over 780 users.

Implementation of GSM-based home security monitoring system with LED touch screen

A home security system is a set of manual or automated system, actions and procedures that provide security and safety features for a home by alarming the residents from natural, accidental and/or human dangers. This paper proposes fabricating a micro-controller-based fully automatic home security system. It comprises a password door lock with an LED touch screen input panel which triggers break-in alarm on a consecutive three time wrong password entry; alarm triggered by motion detector on sensing obstacle between door and window monitored by laser beam; fire alarm system triggered by the detection of sudden increase in temperature. The system is configured with a GSM module which sends a message notification to the owner whenever any alarm is triggered concerning security or safety breach.

Fluorescent probe mimicking multiple logic gates and a molecular keypad lock upon interaction with Hg2+ and bovine serum albumin

The output fluorescence exhibited by an intramolecular charge transfer fluorescent probe 1 providing different chemical inputs mimicked multiple logic gates. A molecular keypad lock security device authorizing password entries (logic memory) and capable of solving crossword puzzles has been constructed by computing the output emission of 1 upon chemical inputs of BSA and Hg(2+). Based on logic operations the devised fluorescent keypad lock could be unlocked upon entering a correct sequence of password, 'BHU'.

DATA SECURITY IN MOBILE DEVICES BY GEO LOCKING

In this paper we present a way of hiding the data in mobile devices from being compromised. We use two level data hiding technique, where in its first level data is encrypted and stored in special records and the second level being a typical password protection scheme. The second level is for secure access of information from the device. In the first level, encryption of the data is done using the location coordinates as key. Location Coordinates are rounded up figures of longitude and latitude information. In the second phase the password entry differs from conventional schemes. Here we have used the patterns of traditional Rangoli for specifying the password and gaining access, thus minimising the chances of data leak in hostile situations. The proposed structure would be a better trade off in comparison with the previous models which use Bio Metric authentication – a relatively costly way of authentication.