A Comparison of a Touch-Gesture- and a Keystroke-Based Password Method: Toward Shoulder-Surfing Resistant Mobile User Authentication
A Comparison of a Touch-Gesture- and a Keystroke-Based Password Method: Toward Shoulder-Surfing Resistant Mobile User Authentication
复制标题
DOI：
10.1109/thms.2023.3236328
复制
发表时间：
2023-04
影响因子：
3.6
通讯作者：
Lina Zhou;Kanlun Wang;Jianwei Lai;Dongsong Zhang
中科院分区：
文献类型：
--
作者：
Lina Zhou;Kanlun Wang;Jianwei Lai;Dongsong Zhang
移动的设备的普遍使用使用户面临肩扛式攻击的更高风险。尽管先前的工作肩冲浪阻力的移动的用户认证方法，有一个缺乏实证研究的文本密码认证方法，特别是混合密码，结合文本密码与生物特征。为了填补文献空白，本研究比较了两种混合密码方法，触摸手势和基于手势的密码，相对于他们的肩冲浪阻力性能。我们选择了一个触摸手势为基础的密码方法，部署多个肩膀冲浪阻力策略和一个基于密码的密码方法，充分利用网络动态。为了全面了解这些密码的方法，我们研究他们在各种肩膀冲浪设置不同的交互模式，观察角度，输入错误，观察工作。除了有效性指标，我们还引入了效率指标，以更全面地评估肩冲浪阻力性能。我们假设和测试肩冲浪设置的影响进行纵向实验室实验和在线实验与多样化的参与者。这两项研究的结果表明，基于触摸手势的密码方法的上级性能优于基于手势的密码方法。研究结果还为交互方式、观察角度和观察努力对混合口令抗肩击性的影响提供了证据。我们的研究结果提供了建议的设计和策略，以加强密码认证方法的安全性。
The pervasive use of mobile devices exposes users to an elevated risk of shoulder-surfing attacks. Despite the prior work on shoulder-surfing resistance of mobile user authentication methods, there is a lack of empirical studies on textual password authentication methods, particularly the hybrid passwords that integrate textual passwords with biometrics. To fill the literature gap, this research compares two hybrid password methods, touch-gesture- and keystroke-based passwords, with respect to their shoulder-surfing resistance performance. We select a touch-gesture-based password method that deploys multiple shoulder-surfing resistance strategies and a keystroke-based password method that leverages keystroke dynamics. To gain a holistic understanding of these password methods, we examine them under a variety of shoulder-surfing settings by varying interaction mode, observation angle, entry error, and observation effort. Going beyond effectiveness metrics, we also introduce efficiency metrics to assess shoulder-surfing resistance performance more comprehensively. We hypothesize and test the effects of shoulder-surfing settings by conducting both a longitudinal lab experiment and an online experiment with diversified participants. The results of both studies demonstrate the superior performance of the touch-gesture-based password method to the keystroke-based counterpart. The results also provide evidence for the effects of interaction mode, observation angle, and observation effort on shoulder-surfing resistance of hybrid passwords. Our findings offer suggestions for the design and strategies for strengthening the security of password authentication methods.