Key challenges stem from the small sample sizes in current gesture password studies and the requirement to use similarity-based recognition metrics, which prevent the application of traditional entropy estimation methods. With the resulting data set, we develop a new multi-stage discretization method and n-gram Markov models that enable us to estimate the partial guessing entropy of gesture passwords and to create a new cluster-based dictionary attack. Password strength meters have previously been proposed as an effective password policy that can improve the security of other authentication techniques such as passwords or patterns.
We validate the effectiveness of gesture strength meter designs on security by conducting a follow-up online study and applying the security framework and attacks established in the first study. This thesis concludes that the gesture password meter can be an effective technique to improve the security of gesture authentication systems that deserves further investigation. This thesis contains material from an article published in the following peer-reviewed conference, where the author of this thesis is listed as first author.
Background
To accurately measure the strength of a gesture password, simple heuristics such as password length and number of non-overlapping symbols are combined with advanced measures such as probability and dictionary match score. We diversify the designed counter by forcing matching with a minimum gesture password strength: default (none), weak, fair, and strong.
Thesis Statement
Thesis Structure
Gesture
As advances in touch-screen devices enable high-resolution input over large areas, proposals have been made for new authentication techniques to protect users' data on their devices [12]. Previous gesture studies have also investigated full-screen and multi-gesture gesture inputs in various touchscreen devices, while we note that gesture password studies have not yet considered the smartphone usage scenario where the input area is limited and only passwords with one move, such as as patterns for Android. While the main focus of very early work was on investigating the performance of gestures to be used as an authentication system, recent works on gestures highlight the performance of recognizers, the utility and security of gestures as a new authentication technique.
Gesture Recognizer
Gesture Usability and Security
Password Improvement Methods
Password Composition Policy
Strength Estimation
In this section, we establish security evaluation metrics for gesture passwords that conduct a large-scale online data collection study.
Security Evaluation Techniques
Preprocessing and Recognition Metric
For a given data set, False Rejection Rates (FRRs), which measure the proportion of users' genuine gestures that are rejected by a gesture algorithm, are calculated by matching different examples of each person's gestures against each other. False acceptance rates (FARs), which measure the proportion of others' movements that are misclassified as users' own, are based on matching an individual's stored movement template with those of all other individuals.
Entropy Assessment
The different models varied the shock discretization and Markov 2-gram parameters to identify the most appropriate model for further study. Higher-order n-gram Markov models (eg 3-grams) were evaluated, as they resulted in a very high proportion of invisible n-gram sequences. The multi-stage process used to generate n-gram Markov models and select a reasonable final model is described below.
First, gestures must be in the form of a sequence of symbols to construct the n-gram Markov model. Because the total number of possible raw coordinates is extremely large, this effectively precludes the use for training a reasonable n-gram Markov model. The tear rate was intended to represent the accuracy of the probability distribution of collected gesture samples in the model.
The number of broken movements is then divided by the total number of movements to calculate the crack rate. This can be calculated by dividing the number of seen n-gram instances by the total number of possible n-gram instances. To further improve the performance of the three n-gram Markov models selected from previous criteria, edge cases in the discretization stage must be considered.
With selected n-gram Markov models, we have calculated the partial guess entropy to evaluate the security of gesture passwords [7]. We report this data in terms of "pieces of information". To calculate this, we first calculate the probability of all possible passwords generated by the chosen optimized n-gram Markov models and sort them in non-increasing order.
Dictionary Assessment
User Study
- Gesture Recognizer
- Study Design
- Participants
- Results
- Password Scoring
- Password Length and Symbol Number
- Markov n-gram Probability
- Dictionary Match Score
Thus, we believe that the model based on discretization in three regions of length and ten angles (3x10) provides a well-balanced combination of high crack rate, close. We note that the model based on discretization in two regions of length and ten angles (2x10) can perform better in terms of cracking rate when the gestures in a group are relatively simple. An interesting result is that the partial guess entropy values of the three n-gram Markov models show steep increases between 𝛼 levels from 0.1 to 0.4.
Distribution of strokes in optimized 2x10 (top row), 3x10 (middle row) and 4x12 (bottom row) n-gram models in the first study. Traditionally, the simplest metrics used for assessing password security are length and number of symbols in a password [10]. However, it is difficult to evaluate security only on length and symbol numbers of a password [26][27].
Common and simple heuristics for estimating password strength are password length and the number of symbols present in a password [10]. A gesture must be composed set of symbols by following DP line simplification, sublayer division and discretization for length and angle as described in section 3.1.2. When a gesture is discretized with optimal discretization parameters (3×10), we can estimate a password length and the number of symbols by counting the number of total and non-overlapping symbols in a set of symbols.
We should bear in mind that the length and symbol number of a discrete gesture is actually related to security measures. A high dictionary matching score of a gesture represents low maximum distances, implying the uniqueness of the corresponding gesture.
Meter Compliance Policies
Meter Visuals
Colored Bar
Text
When a gesture is scored as 'Strong', we do not provide text feedback for individual scoring metrics. We choose to choose common phrases for probability and match score statistics to provide understandable feedback for users. Three text feedbacks are designed for each metric related to the score (maximum 100 points for each).
For the password likelihood score, the meter displays: “It's very easy to guess” (0 to 25), “It's somewhat predictable” (25 to 50), and “It's somewhat unpredictable.” The gestures are scored very weak, weak, honest and strong in the standard compliance policy meter. from left) The score of each gesture is visually displayed with colors (red, orange, yellow and green) and lengths (short, medium, medium and long) of the score bar and text feedback for three scoring categories (length/symbol, probability and match score) .
User Study
- Study Design
- Participants
- Results
- Implications from The First Study
- Selection of Password Meter
- Gesture Samples of The Second Study
- Design of Password Strength Meter
- Gesture Implications
USD 1 is awarded for completing the meter study, which increases from the first study as the new study includes the new practice session and the memory game. Partial conjecture entropy: In the first study, we choose our best n-gram Markov model (length and angle divided into 3 and 10 regions, respectively, phase offset offset, add-1 smoothing, bump exclusion double and optimized limit 14% for length 18% for angle) in multiple criteria. Dictionary attack: We use the top 20 dictionaries of the full set extracted from the first study for the Internet attack scenario.
We use DTW as our recognition metric, as it shows efficacy across protractors on EER and crack rate in the first study. We apply Fisher's exact test to examine significant differences between the first study and compliance policies. Crack rates of weak and default compliance gauges are not significantly different from the first study at system threshold (𝑝 > 0.1).
FRR rate, standard compliance policy does not show any significant difference with weak compliance policy (𝑝 = 0.38) and between fair versus strong compliance policies (𝑝 = 0.89). From the first study, we set several security ratings for gesture passwords and showed how a large proportion of users actually chose vulnerable gestures as their passwords against online guessing attacks. Online dictionary attacks derived from the first study successfully guessed 59.62% of weak compliance moves at the system threshold, and this function was not significantly different from the first study.
We recommend the default policy over any compliance policy for the following reasons: 1) utility cost only - no significant difference in recall rate with the previous rate of 98.9% (𝑝 > 0.05) shorter setup time compared to the strong compliance policy (𝑝 < 0.005 ) and more cooperation with high cancellation compared to other compliance policies (𝑝 < safety improvement - higher partial guess entropy in different 𝛼 values than compliance policies and no significant difference in burst rate at high FRR threshold values (FRR > 8.27%) with a stricter compliance policy (𝑝 > 0.05). Although users in the first study usually chose simple and homogeneous gestures for their passwords, the security improvement using the password strength meter shows that gesture passwords that chosen by users, can be powerful if guided by a proper system and policy.
Conclusion
The case of Android unlock patterns,” in Proceedings of the 2013 ACM SIGSAC Conference on Computer. Lindqvist, “Where usability and security go hand-in-hand: Robust gesture-based authentication for mobile systems,” in Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems, ser. Egelman, "Of passwords and people: Measuring the effect of password-composition policy," in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser.
Is My Password Going Up to Eleven?: The Impact of Password Meters on Password Selection.” In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser. Memon, “Biometrically rich gestures: a new approach to authentication on multi-touch devices,” In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser. Implicit Authentication Based on Touch Screen Patterns,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser.
A reliable recognizer with few samples and many modalities,” in Proceedings of the 2017 CHI Conference on Human Factors in Computing Systems, ser. Li, “Protractor: A fast and accurate gesture recognizer,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser. Schmidt, “Assessing the vulnerability of magnetic gesture authentication to video-based shoulder surfing attacks,” in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser.
Design and Evaluation of a Data-Driven Password Meter." in Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, ser. Beznosov, "Toward Understanding the Relationship Between Age and Smartphone Authentication," in Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems, ser.
