DRAW-A-PIN: Authentication using finger-drawn PIN on touch devices. Issue 66 (May 2017)

• Record Type: Journal Article
• Authors: Nguyen, Toan Van; Sae-Bae, Napa; Memon, Nasir
• Is Part Of: Computers & security. Issue 66(2017)
• Page Start: 115
• Page End: 128
• Publication Date: 2017-05
• Subjects: Gesture authentication -- Finger-drawn PIN -- Behavioral biometric -- Shoulder surfing -- Touch devices; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2017.01.008
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: This paper presents Draw -A-PIN, a user authentication system on a device with a touch interface that supports the use of PINs. In the proposed system, the user is asked to draw her PIN on the touch screen instead of typing it on a keypad. Consequently, Draw -A-PIN could offer better security by utilizing drawing traits or behavioral biometrics as an additional authentication factor beyond just the secrecy of the PIN. In addition, Draw -A-PIN inherently provides acceptability and usability by leveraging user familiarity with PINs. To evaluate the security and usability of the approach, Draw -A-PIN was implemented on Android phones and 3203 legitimate finger-drawn PINs and 4655 forgery samples were collected through an extensive and unsupervised field experiment over 10 consecutive days. Experimental results show that Draw -A-PIN achieves an equal error rate of 4.84% in a scenario where the attacker already knows the PIN by shoulder surfing. Finally, results from a user study based on the System Usability Scale questionnaire confirm that Draw -A-PIN is highly usable.