Personal Identification Numbers Entry Research Articles

ARJUNA: An accessible pin entry model in smartphones for persons with low vision

AbstractUser authentication is the cornerstone of providing secure access to the services in the digital ecosystem. Critical applications such as Banking use Personal Identification Number (PIN)‐based passwords and One Time Passwords (OTP), for transactions to strengthen security. However, persons with visual impairments have often been a soft target for cyber attacks as it is comparatively simpler to make them victims of various attacks. This paper proposes a model titled Accessible Robust Just‐in‐time Numerical Authentication (ARJUNA) to assist PIN entry in smartphones for people with visual impairments. This study has explored several cyber‐attacks on visually impaired users and proposed the ARJUNA model that provides a robust braille‐inspired PIN input for people with visual impairments. The proposed model is implemented as an Android application that users can easily access. Several experiments are conducted with visually impaired users to study the model's performance. The proposed ARJUNA model has shown supportive results in the user study. The robustness of ARJUNA against various attacks is also explored in this article.

Morse Code Based Secured Authentication System through Machine Learning

Data science is a multidisciplinary blend of data inference, algorithm development and technology in order to solve analytically complex problems. Data science is used by almost all the industries like instructive organizations, finance, medical services, business to deal with huge volumes of information. The pragmatic applications range from foreseeing stock development to anticipating disease; utilized in picture preparing to character acknowledgment, sound handling for discourse to message expectation. Since the majority of individuals on the planet are dealing with issues in the field of verification and security. The system provides a real time eye tracing for password authentication for people who authenticate themselves using Morse code. Advancement in the technology of authentication and authorization has be supported in the 21st century a lot as we know. Personal identification numbers (PIN) are widely used for user authentication and security since the late 90's. Since PIN numbers are easily crack able these days, people prefer to follow different approach. PIN validation with hands-off look-based PIN section procedures, then again, abandons no actual impressions and in this manner offers a safer secret word passage alternative. Gaze-based system for authentication alludes to discovering the eye area across consecutive picture frames and following the eye movements by plotting the eye center. Password authentication will be done using Morse code, where numbers will be represented in dots and dashes. This model presents a real-time application for gaze-based PIN entry with face recognition, and eye detection and tracking for PIN identification using a smart camera

OneButtonPIN: A Single Button Authentication Method for Blind or Low Vision Users to Improve Accessibility and Prevent Eavesdropping

A Personal Identification Number (PIN) is a widely adopted authentication method used by smartphones, ATMs, etc. PINs offer strong security and can be reset when compromised (unlike biometric authentication). However, PINs can be inaccessible for blind or low vision (BLV) users due to screen readers voicing PINs to bystanders or potential shoulder surfing attack risks---bystanders could watch the PIN being entered without the user noticing. To address this, we present OneButtonPIN, an interface to improve PIN entry accessibility and security for BLV users. Here, a single on-screen button, when pressed and held, triggers a haptic vibration sequence. A digit is entered by counting the vibrations and releasing the button. We explored introducing random timings to the vibration sequence to increase security. A week-long evaluation with 9 BLV participants and a security study with 10 sighted participants acting as shoulder surfers demonstrated OneButtonPIN's usability and resilience against eavesdropping.

Meta-Heuristic Optimization and Keystroke Dynamics for Authentication of Smartphone Users

Personal Identification Numbers (PIN) and unlock patterns are two of the most often used smartphone authentication mechanisms. Because PINs have just four or six characters, they are subject to shoulder-surfing attacks and are not as secure as other authentication techniques. Biometric authentication methods, such as fingerprint, face, or iris, are now being studied in a variety of ways. The security of such biometric authentication is based on PIN-based authentication as a backup when the maximum defined number of authentication failures is surpassed during the authentication process. Keystroke-dynamics-based authentication has been studied to circumvent this limitation, in which users were categorized by evaluating their typing patterns as they input their PIN. A broad variety of approaches have been proposed to improve the capacity of PIN entry systems to discriminate between normal and abnormal users based on a user’s typing pattern. To improve the accuracy of user discrimination using keystroke dynamics, we propose a novel approach for improving the parameters of a Bidirectional Recurrent Neural Network (BRNN) used in classifying users’ keystrokes. The proposed approach is based on a significant modification to the Dipper Throated Optimization (DTO) algorithm by employing three search leaders to improve the exploration process of the optimization algorithm. To assess the effectiveness of the proposed approach, two datasets containing keystroke dynamics were included in the conducted experiments. In addition, we propose a feature selection algorithm for selecting the proper features that enable better user classification. The proposed algorithms are compared to other optimization methods in the literature, and the results showed the superiority of the proposed algorithms. Moreover, a statistical analysis is performed to measure the stability and significance of the proposed methods, and the results confirmed the expected findings. The best classification accuracy achieved by the proposed optimized BRNN is 99.02% and 99.32% for the two datasets.

Scrambling Keypad for Secure Pin Entry to Defeat Shoulder Surfing and Inference Attacks

Personal identification number (PIN) is a common user authentication method widely used especially for automated teller machines and point-of-sales devices. The user's PIN entry is susceptible to shoulder-surfing and inference attacks, where the attacker can obtain the PIN by looking over the user's shoulder. The conventional keypad with a fixed layout makes it easy for the attacker to infer the PIN entered by casual observation. This paper proposes a method of authentication to address these challenges. The paper develops a prototype numeric keypad with a layout akin to the conventional keypad, with the keys randomized for each PIN entry. The shuffle algorithm, Durstenfeld shuffle algorithm, is implemented in an application developed using JavaScript, which is a prototype-based object-oriented programming application that conforms to the ECMAScript specification. The prototype is implemented on three computing platforms for evaluation. The test proves the effectiveness of the system to mitigate shoulder-surfing and inference attacks.

REAL TIME EYE TRACKING FOR PASSWORD AUTHENTICATION

The Generality of today’s authentication systems, including password , fingerprint scanners and Personal Identification Number(PIN) entry, are based on one time, static authentication methods which are prone to attacks. Real time eye tracking contributes significantly for Patients who are incapacitated, internet study , gaze based password entry as well as house hold security applications. The use of real time eye tracking and password authentication system has a wider possibility for reliability, but in this case the system must be secure and restrained for Eye Detection and Tracking. For the user’s security and validation (authentication) personal identification numbers are used abroad thereby reducing the chances of being attacked. In static authentication methods , since the password has to be entered physically using PIN’s there are possibilities for tracking the password using shoulder surfing, in order to avoid this spy game of tracking the password , hands off gaze- based PIN entry techniques are used. The smart camera is used to detect the eye position and for Gaze-based PIN Identification thereby doing the data processing. This project is focused on a real time hands off and gaze based PIN entry , detecting the eye position and tracking the eye movement using the smart camera.

Behavioral Acoustic Emanations: Attack and Verification of PIN Entry Using Keypress Sounds.

This paper explores the security vulnerability of Personal Identification Number (PIN) or numeric passwords. Entry Device (PEDs) that use small strings of data (PINs, keys or passwords) as means of verifying the legitimacy of a user. Today, PEDs are commonly used by personnel in different industrial and consumer electronic applications, such as entry at security checkpoints, ATMs and customer kiosks, etc. In this paper, we propose a side-channel attack on a 4–6 digit random PIN key, and a PIN key user verification method. The intervals between two keystrokes are extracted from the acoustic emanation and used as features to train machine-learning models. The attack model has a 60% chance to recover the PIN key. The verification model has an 88% accuracy on identifying the user. Our attack methods can perform key recovery by using the acoustic side-channel at low cost. As a countermeasure, our verification method can improve the security of PIN entry devices.

On Overcoming the Identified Limitations of a Usable PIN Entry Method

In the domain of password security, research has made significant progress in handling different kinds of threats which require human intelligence factor to fix the vulnerabilities. In spite of having strong theoretical establishments, most of these defense mechanisms cannot be used in practice as humans have limitations in processing complex information. The little bit of good news is that very few research proposals in this field have shown the promises to be deployable in practice. This paper focuses on such one method - proposed by Roth et al. back in 2004, which provides adequate user-friendliness to enter Personal Identification Number (PIN) securely in the presence of human shoulder surfers. Surprisingly, the background algorithm of this method for validating users’ responses runs in linear time on a search space of cardinality 5 and hence, the validation process does not put much load on the authenticating device. Therefore, such human identification protocol can also be integrated into the IoT infrastructure for conducting a more secured login from the client-side. Having such advantages, though remained secure for almost ten years after its release in 2004, recently, few proposals revealed some serious vulnerable aspects of the Roth et al. ’s proposal. In this paper, we have taken an attempt to save this user-friendly form of authentication. Firstly, we have made a critical discussion on the importance of the targeted PIN entry method in the domain of usable security and then given a brief overview of the identified limitations of this protocol. Followed by this, a few initiatives have been taken to fix the identified vulnerabilities of Roth et al. ’s proposal by revising its working principle, while the login procedure and the usability standard of this method stay unaffected.

Two-Thumbs-Up: Physical protection for PIN entry secure against recording attacks

We present a new Personal Identification Number (PIN) entry method for smartphones that can be used in security-critical applications, such as smartphone banking. The proposed “Two-Thumbs-Up” (TTU) scheme is resilient against observation attacks such as shoulder-surfing and camera recording, and guides users to protect their PIN information from eavesdropping by shielding the challenge area on the touch screen. To demonstrate the feasibility of TTU, we conducted a user study for TTU, and compared it with existing authentication methods (Normal PIN, Black and White PIN, and ColorPIN) in terms of usability and security. The study results demonstrate that TTU is more secure than other PIN entry methods in the presence of an observer recording multiple authentication sessions.

An Enhanced ATM Security System using Second-Level Authentication

increase of automated teller machine (ATM) frauds has actuated the development of new authentication mechanisms that can overcome the security problems associated with the personal identification numbers (PIN). The traditional PIN entry system has stood the test of time mainly because of its speed and memorability which are part of the metrics used to access the ATM authentication system. The third metric, which is security has often been compromised thence the need for a more secured authentication system for ATM operations. This paper therefore proposes an enhanced ATM security system using second level authentication process. The method adopted for this research is to develop an enhancement of the existing system by building an additional security mechanism on the existing systems security mechanism. The proposed system was found to be realistic and cost effective when compared to other proposed authentication mechanism for ATM transactions.

Analysis and Improvement of a PIN-Entry Method Resilient to Shoulder-Surfing and Recording Attacks

Devising a user authentication scheme based on personal identification numbers (PINs) that is both secure and practically usable is a challenging problem. The greatest difficulty lies with the susceptibility of the PIN entry process to direct observational attacks, such as human shoulder-surfing and camera-based recording. This paper starts with an examination of a previous attempt at solving the PIN entry problem, which was based on an elegant adaptive black-and-white coloring of the 10-digit keypad in the standard layout. Even though the method required uncomfortably many user inputs, it had the merit of being easy to understand and use. Our analysis that takes both the experimental and theoretical approaches reveals multiple serious shortcomings of the previous method, including round redundancy, unbalanced key presses, highly frequent system errors, and insufficient resilience to recording attacks. The lessons learned through our analysis are then used to improve the black-and-white PIN entry scheme. The new scheme has the remarkable property of resisting camera-based recording attacks over an unlimited number of authentication sessions without leaking any of the PIN digits.

Establishing user trust in automated teller machine integrity

The authors show that integrity protection as a technical means towards automated teller machine (ATM) security is not enough to establish trust towards ATM users. The attacks, aiming at getting into possession of users' bank card details and personal identification numbers (PINs) are manifold. The authors come up with a solution that allows users to establish trust into the ATM integrity protection being in place. The users' mobile phones play a central role in the trust establishment. The authors also shift the PIN entry away from the possibly insecure ATM's PIN pad towards the users' mobile phones.

How to fend off shoulder surfing

Magnetic stripe cards are in common use for electronic payments and cash withdrawal. Reported incidents document that criminals easily pickpocket cards or skim them by swiping them through additional card readers. Personal identification numbers (PINs) are obtained by shoulder surfing, through the use of mirrors or concealed miniature cameras. Both elements, the PIN and the card, are generally sufficient to give the criminal full access to the victim’s account. In this paper, we present alternative PIN entry methods to which we refer as cognitive trapdoor games. These methods make it significantly harder for a criminal to obtain PINs even if he fully observes the entire input and output of a PIN entry procedure. We also introduce the idea of probabilistic cognitive trapdoor games, which offer resilience to shoulder surfing even if the criminal records a PIN entry procedure with a camera. We studied the security as well as the usability of our methods. The result support the hypothesis that our primary mechanism strikes a balance between security and usability that is of practical value. In this article, we give a detailed account of our mechanisms and their evaluation.

Connected digit recognition based on improved acoustic resolution

The problem of recognizing strings of connected digits is crucial to a number of applications such as voice dialing of telephone numbers, automatic data entry, credit card entry, PIN (personal identification number) entry, entry of access codes for transactions, etc. Algorithms for connected digit recognition, based on whole-word reference patterns, have become increasingly sophisticated and have been shown capable of achieving high-recognition performance. Much of this complexity is derived from the design of specialized word models suitable solely for connected digit recognition. For example, in Doddington (1989), context-dependent modeling for the digits two and four and confusion class models for likely digit confusions were used to give high-performance digit recognition. Historically, the training and modeling techniques developed for connected digit recognition have been improved and successfully incorporated into large-vocabulary recognition systems. Based largely on these techniques, there have been proposed and implemented a number of systems for large vocabulary speech recognition which have achieved high word recognition accuracy. In this paper we reverse the direction of technology flow; namely, we show how we can apply the improved acoustic modeling techniques (using a continuous density hidden Markov model framework), developed for large-vocabulary speech recognition applications, to the problem of connected digit recognition with no changes made to the basic modeling techniques and with no vocabulary-specific information used. The improved modeling techniques adopted in this study include an improved feature analysis procedure, that incorporates higher-order cepstral and log energy time derivatives, and an improved acoustic resolution procedure, that uses more Gaussian mixture components per state to characterize the acoustic variability in each state of the model. Using these techniques, string accuracies of 98·6% for unknown length strings and 99·2% for known length strings were achieved on the standard Texas Instruments connected digits database. These string accuracies are a factor of 2 better than those previously reported using the same modeling procedures (Rabiner, et al., 1989 b), and are even somewhat better than those reported by Doddington using specialized modeling techniques for the digits (Doddington, 1989).