Two-Thumbs-Up: Physical protection for PIN entry secure against recording attacks. Issue 78 (September 2018)

• Record Type: Journal Article
• Authors: Nyang, DaeHun; Kim, Hyoungshick; Lee, Woojoo; Kang, Sung-bae; Cho, Geumhwan; Lee, Mun-Kyu; Mohaisen, Aziz
• Is Part Of: Computers & security. Issue 78(2018)
• Page Start: 1
• Page End: 15
• Publication Date: 2018-09
• Subjects: Authentication -- Personal Identification Number (PIN) -- Smartphone -- Recording attack -- Physical shielding -- User studies; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2018.05.012
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: We present a new Personal Identification Number (PIN) entry method for smartphones that can be used in security-critical applications, such as smartphone banking. The proposed "Two-Thumbs-Up" (TTU) scheme is resilient against observation attacks such as shoulder-surfing and camera recording, and guides users to protect their PIN information from eavesdropping by shielding the challenge area on the touch screen. To demonstrate the feasibility of TTU, we conducted a user study for TTU, and compared it with existing authentication methods (Normal PIN, Black and White PIN, and ColorPIN) in terms of usability and security. The study results demonstrate that TTU is more secure than other PIN entry methods in the presence of an observer recording multiple authentication sessions.