New directions in multisensory authentication

This paper discusses and evaluates two novel multisensory user authentication mechanisms aimed at preventing observation attacks. These mechanisms improve the usability of our previous work by reducing authentication times, and are more suitable for portable and mobile devices. 1. Background and Motivation The ability to authenticate users is crucial to most modern information systems. For instance, a mobile phone has to have some primitives in place to ensure that the person using the device is its legitimate owner, and not an unauthorized third-party; a banking terminal needs the ability to establish that the person using a given banking card is the holder of the corresponding account. However, most user authentication systems rely on methods vulnerable to observation attacks. In an observation attack, an unauthorized party records the actions the legitimate user performs to authenticate and later reuses the recorded information to impersonate the user. A common instance of observation attacks is shoulder-surfing, where the impostor snoops over the shoulder of a legitimate user entering his/her password to successfully capture it. Besides shoulder-surfing, observation techniques that have proven successful include photo capture from a distance [1], audio recording of keyboard clicking sounds [2], miniaturized video recorders [3], and even biometric replication [4]. In previous work [3], we argued for a novel line of defense against observation attacks. Instead of trying to conceal user input, we hide the authentication challenges presented to the users. Think of an authentication session as a question-answer exchange (“What is the password? ‘Buddy’.”) Proposals so far have focused on trying to hide the answer (‘Buddy’). We postulate hiding (part of) the question is more usable and secure. To that effect, we break the challenge question into two parts. The first part of the challenge is conveyed through a visible, observable, channel, while the second part of the challenge is conveyed through a hidden channel. The user mentally reassembles both parts, and answers the reassembled challenge. The authentication system can verify the answer by combining its own knowledge of the correct response and of what was sent on both channels. Conceptually, instead of asking “What is the password? ”, we ask aloud “Does your password contains a ‘d’? ” (visible challenge) while whispering to the user’s ear “Tell a lie,” or “Tell the truth” (hidden challenge). The user answers, e.g., “Yes. ” For an outsider unable to observe the whisper in the ear, the user’s answer does not give her any clue whether there is a ‘d’ in the password or not. Either there is indeed a ‘d’ in the password, and s/he was told to tell the truth, or there is no ‘d’ in the password, but s/he was instructed to tell a lie. Both cases are indistinguishable to the observer. An important research question lies in the implementation of the hidden channel. Our previous work 1Utsunomiya University, IS Dept., Utsunomiya, Japan and Carnegie Mellon University, CyLab Japan, Kobe, Japan 2Carnegie Mellon University, Information Networking Institute and CyLab, Pittsburgh, PA, USA 3Carnegie Mellon University, School of Computer Science, Pittsburgh, PA, USA (a) System overview (b) Visual channel (c) Tactile channel Figure 1. Tactile-based prototype. [3] showed that using a trackball is successful in protecting against observation attacks, as the trackball movement is hidden by the hand of the user and very hard to observe by an attacker. However, 1) authentication times with such a device are quite long, in the order of tens of seconds to a minute, and 2) a bulky trackball is acceptable for fixed, large-size authentication terminals, but is unsuitable for portable devices such as mobile phones. We set out to investigate alternate methods for delivering the hidden signal, and report on a pilot study we conducted of two novel multisensory authentication mechanisms. The first mechanism implements the hidden channel through a tactile device. The second mechanism uses an audio channel to convey hidden signals.