Analysis and Improvement on a Unimodal Haptic PIN-Entry Method

Hindawi Mobile Information Systems Volume 2017, Article ID 6047312, 17 pages https://doi.org/10.1155/2017/6047312 Research Article Analysis and Improvement on a Unimodal Haptic PIN-Entry Method Mun-Kyu Lee,1 Jin Yoo,2 and Hyeonjin Nam3 1 Department of Computer Engineering, Inha University, Incheon 22212, Republic of Korea 2LG Electronics, Seoul 06267, Republic of Korea 3Vieworks,Anyang14055,RepublicofKorea Correspondence should be addressed to Mun-Kyu Lee; [email protected] Received 14 March 2017; Revised 24 July 2017; Accepted 15 August 2017; Published 2 October 2017 Academic Editor: Stefania Sardellitti Copyright © 2017 Mun-Kyu Lee et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. User authentication is a process in which a user of a system proves his/her identity to acquire access permission. An effective user authentication method should be both secure and usable. In an attempt to achieve these two objectives, Bianchi et al. recently proposed novel unimodal PIN-entry methods that use either audio or vibration cues. This paper analyzes the security of their method, in particular, the vibration version of one of their proposals, Timelock. A probabilistic analysis and real attack experiment reveal that the security level guaranteed by Timelock is lower than that claimed in Bianchi et al.’s paper. As countermeasures to this problem, three PIN-entry methods are proposed and a usability study is performed. According to the result of this study, a simple modification may improve the security significantly while retaining the design philosophy of unimodal systems. In addition, the proposed methods address the PIN compatibility issue of Timelock and they can be used to enter a legacy numerical PIN without any change in the PIN. 1. Introduction enters a response that can only be computed by combining thechallengeandsecretPIN.Theamountofinformationin User authentication is a process in which a user of a a challenge-response pair should be sufficiently large so that system proves his/her identity to acquire access permission an attacker who does not know the PIN cannot deduce any forthatsystem.Foruserauthentication,threeapproaches useful information about the PIN from the observed pair. For are typically adopted, that is, knowledge-based (e.g., pass- usability, however, the challenge is designed to be a simple word), object-based (e.g., ID card), and biometric-based question that a legitimate human user can easily answer. One (e.g., fingerprint) authentication models, among which the of the well-known challenge-response methods is the binary most prevalent form is the first [1]. Personal Identification method proposed by Roth et al. [2]. The layout of this method Numbers (PINs) are a special form of the first category, and is similar to that of the legacy 4×3PIN pad except that they are used for various purposes such as Automatic Teller each digit, 0,1,...,9, is displayed with a background color, Machines (ATMs), digital door locks, and smartphones. either black or white. Among the ten numbers, five numbers However, the traditional PIN-entry mechanism, in which a are colored black and the other five white, where the color user directly touches the PIN digits on a numeric keypad, is assignment is decided randomly by the authenticator. The very vulnerable to observation attacks by a shoulder-surfing user recognizes the background color of the number s/he attacker [2]. That is, a shoulder-surfing attacker may memo- wants to enter and enters that color by touching a button, rize a victim’s PIN after observing the log-on procedure over either “Black” or “White,” instead of entering the PIN digit the victim’s shoulder. This weakness of PINs has motivated directly. Then, the user’s binary input is consistent with five the development of randomized authentication methods numbers. That is, from the authenticators’ point of view, the that adopt challenge-response procedures [2–5]. In these user’sPINdigitcouldbeoneofthesefivenumbers.Four methods, a user is provided with a random challenge and rounds of the above procedure enable the authenticator to 2 Mobile Information Systems 4 uniquely identify the user’s target number as 2 >10.Asa and its entry time, keeping the counting-based approach result, a user has to perform 16 rounds to enter a four-digit secure against observation attacks. This claim was supported PIN. A PIN-entry method that involves randomness can also by an attack experiment involving three human attackers, but be an effective countermeasure against a smudge attack where no numerical evidence was given about the exact level of an attacker analyzes finger smudges on a touchscreen [6, 7]. security guaranteed by the proposed mechanism. Recently, it was discovered that the binary method is The motivation for secondary channel-based methods actually vulnerable to well-trained human attackers, and is their higher security which justifies their relatively low PIN-entry methods that are more resistant to such attacks usability compared to other methods such as regular PIN- have been proposed [8, 9]. The design goal of these methods entry using a legacy PIN pad. Therefore, it would be more as well as the binary method is to prevent an observation desirable to either give rigorous proof or quantify the guar- attack by a human observer who does not use a recording anteed security level. The purpose of this study is to quantify device, and thus such countermeasures are suitable for the and improve the security of the counting-based approach. few situations in which an attacker cannot use a recording We show that a much greater bias exists in the PIN-entry device such as a phone camera [8]. In contrast, the above time according to the PIN value than that recognized in [19], methods cannot protect a PIN if an attacker can gather implying that time randomization is not sufficient to hide challenge-response pairs using a hidden recording device the correlation. We verify this fact by both a mathematical without being detected and s/he can perform an offline anal- analysis and a real attack experiment. ysis on the obtained data. An attacker can further enhance The idea of attacking a PIN-entry method using its time his/her attack capability by using automated analysis tools variation was previously used in [21, 22], and this type of and nontrivial visual information such as reflections in a attack is called a timing attack.Ourattackmayalsobeviewed victim’s sunglasses [10, 11]. Therefore, a PIN-entry method as a timing attack, but the difference of our attack from those with recording resilience is required. However, it was proved in [21, 22] is that we use the variation in the transmission in [8] that the resistance to recording attacks can only be time of a system-generated challenge, and thus the attack is achieved by sacrificing the resistance to random guessing supposed to work equivalently for any victim user. On the attacks if the challenge-response pairs are observable. In other contrary, in the target systems of the attacks in [21, 22], the words, if a PIN-entry method is designed to be secure against challenge transmission time does not vary, but the feasibility recording attacks, the attacker’s chance of successful log-on of an attack depends on a victim user’s response time due to by entering a random PIN is increased, which causes another thevariationsinhumancognitiveload. kind of problem. As a result, the only solution for recording To resolve the issue of time bias while maintaining the resilience without sacrificing random guessing resilience isto advantages of the original system, we propose three counter- design a PIN-entry method whose challenge-response pairs measures such that the PIN-entry time is independent of the cannot be observed by an attacker. To achieve this goal, many PIN digits. Our first, second, and third countermeasures are authentication methods using secondary data channels such designed to utilize three intrinsic characteristics of numbers, as audio and haptic cues have been proposed [12–18]. These that is, cardinal (for quantity), ordinal (for order or rank), methods aim to protect either challenges or responses from and nominal (for symbolic use) characteristics, respectively. an attacker’s visual observation. In the first countermeasure, Addlock, a user counts the In this paper, we concentrate on the authentication meth- number of vibration cues for a fixed time interval and ods using vibration. Recently, Bianchi et al. proposed three enters the sum of the counter value and the PIN digit. authentication methods, Spinlock, Colorlock, and Timelock, The second countermeasure, Counter Phone Lock, isa which are based on a simple counting mechanism [19]. novel combination of the counting-based approach with the Although the proposal in [19] provides both variants, that previous solution, Phone Lock [16]. That is, it uses the order is, audio and haptic versions, the above simple counting between PIN numerals, 0,1,2,...,9. This is in contrast to mechanism is effective, in particular, for the haptic mode. the original counting-based methods in [19] and our first The methods in [19] adopt a novel unimodal approach. countermeasure, in which the PIN numerals are regarded That is, they depend only on vibration cues and do not as cardinal numbers. The third countermeasure, Map lock, useanyvisualcues[19].Theyarebasedonthefindingin regardsthePINdigitsassymbolsandusesonlyasingle cognitive science that users engaged in nontrivial cognitive vibration cue as a hidden indicator. Addlock and Counter tasks perform worse when asked to split their focus over Phone Lock keep the unimodal approach in [19], while Map multiple sensory channels [20]. Roughly speaking, the main lockasksausertoperformbimodaltasksinvolvingvisualand concept of [19] is to ask users to simply count the number vibration challenges.

Load more