Pass-O: A Proposal to Improve the Security of Pattern Unlock Scheme
Pass-O: A Proposal to Improve the Security of Pattern Unlock Scheme
复制标题
Pass-O：一种提高模式解锁方案安全性的提案
DOI：
10.1145/3052973.3053041
复制
发表时间：
2017
期刊：
影响因子：
--
通讯作者：
Ketan Vyas
中科院分区：
文献类型：
--
作者：
Harshal Tupsamudre;Vijayanand Banahatti;S. Lodha;Ketan Vyas
图形模式解锁方案要求用户在3X3网格上连接至少4个节点，这是移动设备上最流行的身份验证机制之一。然而，先前的研究表明，用户的模式选择是高度偏见的，因此很容易受到猜测攻击。此外，3X3模式的选择是缺乏功能，如更长的行程长度，方向变化和交叉点，被认为是防止肩冲浪攻击的重要。我们将这些不安全的做法归因于网格的几何形状及其复杂的绘图规则，这些规则阻止用户实现图形密码的全部潜力。在本文中，我们提出并探索了一种称为Pass-O的替代圆形布局，它与网格布局不同，允许任意两个节点之间的连接，从而简化了图案绘制规则。因此，Pass-O产生的理论搜索空间为9,85,824，几乎是3X3网格布局的2.5倍。我们从理论上和经验上比较了3X3和Pass-O模式的安全性。从理论上讲，Pass-O图案是均匀的，并且由于大量的交叉点而具有较大的视觉复杂性。为了进行实证分析，我们进行了大规模的基于网络的用户研究，从21,053个用户中收集了超过1,23,000个模式。在检查了用户选择的3X3和Pass-O模式的不同指标（如模式长度、笔画长度、起点、终点、重复次数、方向变化数量和交叉点）后，我们发现Pass-O模式比3X3模式更安全。
The graphical pattern unlock scheme which requires users to connect a minimum of 4 nodes on 3X3 grid is one of the most popular authentication mechanism on mobile devices. However prior research suggests that users' pattern choices are highly biased and hence vulnerable to guessing attacks. Moreover, 3X3 pattern choices are devoid of features such as longer stroke lengths, direction changes and intersections that are considered to be important in preventing shoulder-surfing attacks. We attribute these insecure practices to the geometry of the grid and its complicated drawing rules which prevent users from realising the full potential of graphical passwords. In this paper, we propose and explore an alternate circular layout referred to as Pass-O which unlike grid layout allows connection between any two nodes, thus simplifying the pattern drawing rules. Consequently, Pass-O produces a theoretical search space of 9,85,824, almost 2.5 times greater than 3X3 grid layout. We compare the security of 3X3 and Pass-O patterns theoretically as well as empirically. Theoretically, Pass-O patterns are uniform and have greater visual complexity due to large number of intersections. To perform empirical analysis, we conduct a large-scale web-based user study and collect more than 1,23,000 patterns from 21,053 users. After examining user-chosen 3X3 and Pass-O patterns across different metrics such as pattern length, stroke length, start point, end point, repetitions, number of direction changes and intersections, we find that Pass-O patterns are much more secure than 3X3 patterns.