PIN-entry Method Research Articles

Secure PIN-Entry Method Using One-Time PIN (OTP)

The regular PIN-entry method has been still the most common method of authentication for systems and networks. However, PINs are easy to be captured through various attacks, including shoulder-surfing, video-recording, and spyware. This could be attributed to the involuntary nature of entering the original PIN during authentication. In this paper, we employ an indirect input method that utilizes the addition mod 10 and a mini-challenge keypad in order to produce a one-time PIN (OTP) that obscures the original PIN. The results of our user study manifest that the proposed PIN-entry method provides better security than the existing PIN-entry methods while maintaining an acceptable level of usability. Moreover, the user feedback fully support the use of the proposed PIN-entry method in critical-security situations.

Indirect PIN Entry Method for Mobile Banking Using Relative Location Information of Secret Code

Indirect PIN Entry Method for Mobile Banking Using Relative Location Information of Secret Code

Shoulder-surfing resistant PIN-entry method

Shoulder-surfing resistant PIN-entry method

PathGazePIN: Gaze and Path-based Authentication Entry Method

In these days, smartphones are being widely used, people use them to store sensitive and private information. The password authentication is the most used authentication method, however, the password can be disclosure through shoulder surfing attack, since the users write their password in public places and they tend to make the password easy to remember which increase the vulnerability to attacks. Many authentications schemes were proposed to prevent shoulder surfing attack, but they still vulnerable to shoulder surfing attack or have accuracy problems or lack in usability. In this paper, we proposed a gaze-text based PIN entry method, which we called PathGazePIN. It will utilize the user's eye movement to enter the password. The main idea is allowing the user to authenticate by following numbers that move along fixed paths on the screen by using two authentication interfaces: random interface and sorted interface. The results represented that the proposed system will increase the security against shoulder surfing attack as well as usability and accuracy.

Analysis and Improvement on a Unimodal Haptic PIN-Entry Method

User authentication is a process in which a user of a system proves his/her identity to acquire access permission. An effective user authentication method should be both secure and usable. In an attempt to achieve these two objectives, Bianchi et al. recently proposed novel unimodal PIN-entry methods that use either audio or vibration cues. This paper analyzes the security of their method, in particular, the vibration version of one of their proposals, Timelock. A probabilistic analysis and real attack experiment reveal that the security level guaranteed by Timelock is lower than that claimed in Bianchi et al.’s paper. As countermeasures to this problem, three PIN-entry methods are proposed and a usability study is performed. According to the result of this study, a simple modification may improve the security significantly while retaining the design philosophy of unimodal systems. In addition, the proposed methods address the PIN compatibility issue of Timelock and they can be used to enter a legacy numerical PIN without any change in the PIN.

Secure bimodal PIN-entry method using audio signals

A Personal Identification Number (PIN) is a multiple-digit sequence widely used for user authentication. It is desirable for a PIN-entry method to be secure against two main security threats, random guessing attacks and recording attacks. Although there have been many proposals for challenge-response-based PIN-entry methods, it is well known that the only way to prevent both attacks is to physically prevent attackers from observing the challenge-response pairs, which motivates the development of PIN-entry methods that use secure secondary channels such as audio signals. To provide a guideline for designing an audio-based PIN-entry method, we propose a simple framework to transform a non-audio-based method into an audio-based one. We also present a new PIN-entry method that improves the performance of this simple transformation. Most audio-based methods in the literature are unimodal methods, that is, they transmit almost all required information through an audio channel because it was believed that this approach maximized the user's performance. In this paper, however, we show that a carefully designed bimodal system may be more usable than a unimodal one. We present a new PIN-entry method whose audio channel only transmits the minimal required data while most of the challenge information is transmitted through the efficient visual channel. Our user study shows that the PIN-entry time of the proposed method is shorter than those of the previous audio-based methods, while its error rate is kept as low as that of the previous methods.

Analysis and Improvement of a PIN-Entry Method Resilient to Shoulder-Surfing and Recording Attacks

Devising a user authentication scheme based on personal identification numbers (PINs) that is both secure and practically usable is a challenging problem. The greatest difficulty lies with the susceptibility of the PIN entry process to direct observational attacks, such as human shoulder-surfing and camera-based recording. This paper starts with an examination of a previous attempt at solving the PIN entry problem, which was based on an elegant adaptive black-and-white coloring of the 10-digit keypad in the standard layout. Even though the method required uncomfortably many user inputs, it had the merit of being easy to understand and use. Our analysis that takes both the experimental and theoretical approaches reveals multiple serious shortcomings of the previous method, including round redundancy, unbalanced key presses, highly frequent system errors, and insufficient resilience to recording attacks. The lessons learned through our analysis are then used to improve the black-and-white PIN entry scheme. The new scheme has the remarkable property of resisting camera-based recording attacks over an unlimited number of authentication sessions without leaking any of the PIN digits.

Covert Attentional Shoulder Surfing: Human Adversaries Are More Powerful Than Expected

When a user interacts with a computing system to enter a secret password, shoulder surfing attacks are of great concern. To cope with this problem, previous methods presumed limited cognitive capabilities of a human adversary as a deterrent, but there was a pitfall with the assumption. In this paper, we show that human adversaries, even without a recording device, can be more effective at eavesdropping than expected, in particular by employing cognitive strategies and by training themselves. Our novel approach called covert attentional shoulder surfing indeed can break the well known PIN entry method previously evaluated to be secure against shoulder surfing. Another contribution in this paper is the formal modeling approach by adapting the predictive human performance modeling tool for security analysis and improvement. We also devise a defense technique in the modeling paradigm to deteriorate severely the perceptual performance of the adversaries while preserving that of the user. To the best of our knowledge, this is the first work to model and defend the new form of attack through human performance modeling. Real attack experiments and user studies are also conducted.

Security Notions and Advanced Method for Human Shoulder-Surfing Resistant PIN-Entry

The personal identification number (PIN) is a well-known authentication method used in various devices, such as ATMs, mobile devices, and electronic door locks. Unfortunately, the conventional PIN-entry method is vulnerable to shoulder-surfing attacks. Consequently, various shoulder-surfing resistant methods have been proposed. However, the security analyses used to justify these proposed methods are not based on rigorous quantitative analysis, but instead on the results of experiments involving a limited number of human attackers. In this paper, we propose new theoretical and experimental techniques for quantitative security analysis of PIN-entry methods. We first present new security notions and guidelines for secure PIN-entry methods by analyzing the existing methods under the new framework. On the basis of these guidelines, we develop a new PIN-entry method that effectively obviates human shoulder-surfing attacks by significantly increasing the amount of short-term memory required in an attack.