PassWalk: Spatial Authentication Leveraging Lateral Shift and Gaze on Mobile Headsets
Kumar, Abhishek; Lee, Lik Hang; Chauhan, Jagmohan; Su, Xiang; Hoque, Mohammad A.; Pirttikangas, Susanna; Tarkoma, Sasu; Hui, Pan (2022-10-10)
ACM
10.10.2022
Kumar, A., Lee, L.-H., Chauhan, J., Su, X., Hoque, M. A., Pirttikangas, S., Tarkoma, S., & Hui, P. (2022). Passwalk: Spatial authentication leveraging lateral shift and gaze on mobile headsets. Proceedings of the 30th ACM International Conference on Multimedia, 952–960. https://doi.org/10.1145/3503161.3548252
https://rightsstatements.org/vocab/InC/1.0/
© ACM 2022. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in MM '22: Proceedings of the 30th ACM International Conference on Multimedia, https://doi.org/10.1145/3503161.3548252
https://rightsstatements.org/vocab/InC/1.0/
© ACM 2022. This is the author's version of the work. It is posted here for your personal use. Not for redistribution. The definitive Version of Record was published in MM '22: Proceedings of the 30th ACM International Conference on Multimedia, https://doi.org/10.1145/3503161.3548252
https://rightsstatements.org/vocab/InC/1.0/
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:oulu-202404232895
https://urn.fi/URN:NBN:fi:oulu-202404232895
Tiivistelmä
Abstract
Secure and usable user authentication on mobile headsets is a challenging problem. The miniature-sized touchpad on such devices becomes a hurdle to user interactions that impact usability. However, the most common authentication methods, i.e., the standard QWERTY virtual keyboard or mid-air inputs to enter passwords are highly vulnerable to shoulder surfing attacks. In this paper, we present PassWalk, a keyboard-less authentication system leveraging multi-modal inputs on mobile headsets. PassWalk demonstrates the feasibility of user authentication driven by the user's gaze and lateral shifts (i.e., footsteps) simultaneously. The keyboard-less authentication interface in PassWalk enables users to accomplish highly mobile inputs of graphical passwords, containing digital overlays and physical objects. We conduct an evaluation with 22 recruited participants (15 legitimate users and 7 attackers). Our results show that PassWalk provides high security (only 1.1% observation attacks were successful) with a mean authentication time of 8.028s, which outperforms the commercial method of using the QWERTY virtual keyboard (21.5% successful attacks) and a research prototype LookUnLock (5.5% successful attacks). Additionally, PassWalk entails a significantly smaller workload on the user than the current commercial methods.
Secure and usable user authentication on mobile headsets is a challenging problem. The miniature-sized touchpad on such devices becomes a hurdle to user interactions that impact usability. However, the most common authentication methods, i.e., the standard QWERTY virtual keyboard or mid-air inputs to enter passwords are highly vulnerable to shoulder surfing attacks. In this paper, we present PassWalk, a keyboard-less authentication system leveraging multi-modal inputs on mobile headsets. PassWalk demonstrates the feasibility of user authentication driven by the user's gaze and lateral shifts (i.e., footsteps) simultaneously. The keyboard-less authentication interface in PassWalk enables users to accomplish highly mobile inputs of graphical passwords, containing digital overlays and physical objects. We conduct an evaluation with 22 recruited participants (15 legitimate users and 7 attackers). Our results show that PassWalk provides high security (only 1.1% observation attacks were successful) with a mean authentication time of 8.028s, which outperforms the commercial method of using the QWERTY virtual keyboard (21.5% successful attacks) and a research prototype LookUnLock (5.5% successful attacks). Additionally, PassWalk entails a significantly smaller workload on the user than the current commercial methods.
Kokoelmat
- Avoin saatavuus [37744]