touchin sightless two factor authentication on multi touch mobile devices

• DOI: 10.48550/arxiv.1402.1216
• Publication Date: 2014-10-01
• Authors: Jingchao Sun; Yanchao Zhang; Rui Zhang; Jinxue Zhang
• Keywords: FOS: Computer and information sciences; Computer Science - Cryptography and Security; 0202 electrical engineering, electronic engineering, information engineering; 02 engineering and technology; Cryptography and Security (cs.CR)

Mobile authentication is indispensable for preventing unauthorized access to multi-touch mobile devices. Existing mobile authentication techniques are often cumbersome to use and also vulnerable to shoulder-surfing and smudge attacks. This paper focuses on designing, implementing, and evaluating TouchIn, a two-factor authentication system on multi-touch mobile devices. TouchIn works by letting a user draw on the touchscreen with one or multiple fingers to unlock his mobile device, and the user is authenticated based on the geometric properties of his drawn curves as well as his behavioral and physiological characteristics. TouchIn allows the user to draw on arbitrary regions on the touchscreen without looking at it. This nice sightless feature makes TouchIn very easy to use and also robust to shoulder-surfing and smudge attacks. Comprehensive experiments on Android devices confirm the high security and usability of TouchIn.