# Double-X: Towards Double-Cross-Based Unlock Mechanism on Smartphones

Wenjuan Li, Jiao Tan, Nan Zhu

► To cite this version:

Wenjuan Li, Jiao Tan, Nan Zhu. Double-X: Towards Double-Cross-Based Unlock Mechanism on Smartphones. 37th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2022, Copenhagen, Denmark. pp.412-428, 10.1007/978-3-031-06975-8_24. hal-05319894

HAL Id: hal-05319894

https://inria.hal.science/hal-05319894v1

Submitted on 17 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Double-X: Towards Double-Cross-Based Unlock Mechanism on Smartphones

Wenjuan Li¹(✉), Jiao Tan², and Nan Zhu²

¹ Department of Electronic and Information Engineering, The Hong Kong Polytechnic University, Hong Kong, China

wenjuan.li@polyu.edu.hk

² KOTO Research Center, Macao, China

**Abstract.** Thanks to the convenience and the increasing functionalities, mobile devices especially smartphones are becoming an essential electronic device in people's daily lives. Users can take the smartphone for online shopping and payment, as well as chatting with friends. However, with more private and sensitive information stored on such devices, how to secure the phone data becomes an open challenge. To protect a smartphone from unauthorized access, a direct and intuitive approach is to deploy an unlock mechanism, which requires users to input a correct pattern and unlock the phone. In the literature, combining behavioral biometrics can further enhance the security of unlock mechanisms, e.g., Android unlock patterns. In this work, we develop Double-X, a double-cross-based unlock scheme that requires users to unlock the phone by inputting two cross shapes on the selected dots. To authenticate the user, Double-X has to check the selected dots and the behavioral features when drawing the cross shapes. To examine the scheme performance, we perform two user studies with 80 participants with several typical supervised algorithms. The results indicate that participants can achieve a good success rate (e.g., 95%) under our scheme compared with two similar schemes.

**Keywords:** User authentication · Double cross · Behavioral authentication · Unlock mechanism · Touch dynamics

## 1 Introduction

Smartphone is a portable device that integrates various functions such as mobile telephone and computing resources into one unit. A recent survey from IDC [1] indicated that phone vendors shipped a total of 362.4 million smartphones during the last quarter (4Q21) in 2021, resulting in a 5.7% increase in shipments (i.e., with a number of 1.35 billion smartphones shipped). According to Statista [2], the number of smartphone users around the world in 2021 is 6.648 billion, and this means 83.89% of the world's population owns a smartphone.

Currently, smartphones have become much popular and competent with many fancy features. For example, a smartphone allows users to access web-pages and browse the web, operate on documents, play music and games, take
photos and record videos. In this case, smartphones may collect and store a large number of personal and private data/information, while how to safeguard the stored data is a big challenge. Hence user authentication is a necessary security mechanism to enforce access control against unauthorized users.

For user authentication, password-based authentication (e.g., textual passwords, unlock patterns) is still the most widely adopted method, while it suffers from known security and usability limitations. In the aspect of usability, common users are hard to remember complicated and multiple passwords for a long time for the sake of the long-term memory limitation and multiple password interference [29,30]. In this case, most users would like to select an easy-to-remember password, which is often a weak password in practice [5, 46]. On the other hand regarding security, password-based authentication could be easily captured and recorded by attackers, i.e., recording attack [34] and charging attack [27,28], where cyber attackers can monitor and record users' input on the phone screen and then exfiltrate required data and information.

In addition to textual passwords, graphical password (GP) is another alternative that requires users to unlock their smartphones by inputting a correct pattern. Currently, Android unlock patterns are the most popular GP, which allows users to create a pattern within a grid of 3 × 3 [25,26]. Previous research has proved that people can usually remember images better than textual information [35], which motivates the development of GP. However, GP may encounter similar security limitations the same as traditional textual passwords, such as recording attacks and charging attacks. Moreover, with only 9 dots on the grid of 3×3, brute force attack is still feasible as Android unlock patterns can only have 389,112 possible patterns. Also, cyber attackers can further decrease the password space by conducting a smudge attack to recover the touch trails remained on the touch screen [3]. In the aspect of usability, GP may also increase the memory burden according to specific design methods, i.e., *PassPoints* [45] allows users to create credentials by selecting some locations on an image, whereas it may cause a high error rate for some users.

To enhance the security of GP like Android unlock patterns, there are two general directions in the literature. One is to increase the pattern complexity, for example, Forman and Aviv [10] introduced a method to increase the security of Android unlock patterns, called Double Patterns, allowing users to choose two sequential, superimposed patterns as their unlock pattern. Another direction is to combine unlock patterns with behavioral biometrics, for example, De Luca et al. [6] introduced a method by combining Android unlock patterns with behavioral features (e.g., touch coordinates) by means of dynamic time warping (DTW). In this way, the authentication process needs to verify not only the input patterns, but also how users input the pattern. Similarly, Li et al. [17,18] introduced SwipeVlock, an unlock mechanism that verifies users based on the unlock patterns and their swipe actions.

Motivated by this developing trend, in this work, we advocate the merit of designing a phone unlock mechanism by combining behavioral biometrics. We particularly develop a double-cross-based unlock mechanism (called *Double-X*)
to enhance Android unlock patterns, whereby a user can draw two cross shapes by selecting two dots on a 3 × 3 grid. For authentication, Double-X has to verify the selected dots and how users input the cross shapes, namely the touch behavioral features. The contributions can be summarized as below.

- We develop Double-X, a double-cross-based unlock scheme on smartphones, which can verify users based on their selected dots and the touch behavioral features. For registration, users have to select two dots on the 3 × 3 grid and input two cross shapes on the pre-selected dots. A successful authentication trial requires both correct inputs. The scheme design is considered as transparent and easy-to-use.

- For our current scheme, we allow users to select the same dot and input two cross shapes. To model a user's touch behavior, we actually need to verify users' touch movement. In this work, we extract a set of behavioral features such as touch movement speed & direction, touch pressure, time difference, and acceleration.

- In the evaluation, we involve a total of 80 common phone users to explore the classifier selection and the performance of Double-X. Based on the collected data and users' feedback, our results indicate the viability and usability of our scheme as compared with two similar unlock schemes.

The rest of this work is structured as follows. Section 2 introduces related work on unlock mechanisms and behavioral authentication. Section 3 introduces our developed Double-X in detail, and Sect. 4 presents two approved user studies with 80 participants as compared with two similar unlock schemes. We conclude our work in Sect. 5.

# 2 Related Work

## 2.1 Phone Unlock Mechanism

To design an unlock scheme is a basic and important security solution to defeat unauthorized access to mobile platforms, especially smartphones. For example, Android unlock patterns are a typical and popular unlock mechanism on Android phones, which requires users to unlock the screen by drawing a correct pattern [6, 26]. In the literature, Android unlock patterns were indeed extended from an authentication scheme called Pass-Go [41], whereby a user needs to authenticate by generating a pattern on an image.

Due to the easy-to-use characteristic, various phone unlock schemes have been proposed in the literature. For instance, a Face Unlock system was proposed by Findling and Mayrhofer [8], which could verify both frontal and profile face information during a pan shot around the user's head. This scheme relied on a camera and movement sensor to capture the features and could provide a success rate at roughly 90.5%. DeLucaUnLock scheme [6] combined the original Android unlock patterns with touch dynamics, by considering behavioral features and performing a match through dynamic time warping (DTW). Guo et al. [12]
introduced an unlock mechanism called OpenSesame, which could authenticate a user in terms of shaking behavior. Their study found support vector machine (SVM) was a fit to their scheme. In the evaluation, OpenSesame could provide a false negative rate of 11% (with a deviation of 2%) and a false positive rate of 15% (with a deviation of 2.5%). With the development of phone sensors, accelerometer and pressure features can be considered. Izuta et al. [13] developed an unlock scheme by verifying the behavioral features when a user takes a phone from the pocket and the pressure distribution when the user grips the phone. In the study, this scheme could provide a false acceptance rate of 0.43 with only 18 training instances. Meng et al. [26] designed a touch movement-based solution to enhance the security of Android unlock patterns, which requires users to draw the correct pattern and behave soundly.

Then Yi et al. [47] designed an unlock scheme called WearLock, which relies on the signal detection through preamble identification, time synchronization using preamble and cyclic prefix, channel estimation, etc. In the study with 5 users, their scheme provided a success rate of around 90%. Wang et al. [43] presented an unlock scheme based on the heartbeat vibration that can be captured by built-in accelerometer. Users could unlock the phone by pressing the device on their chest for seconds, as the scheme can collect heartbeat signals and verify the user with several heartbeats. They involved 35 participants in the study, and gathered more than 110,000 heartbeat samples. When using 5 heartbeat cycles, their scheme could achieve an Equal Error Rate (EER) of 3.51%. Then a swipe-based unlock scheme was proposed by Li et al. [17, 18] called SwipeVLock, whereby a user can be authenticated by selecting a location on an image and performing a swiping action. A success rate of 98% could be achieved in the best scenario. Forman and Aviv [10] introduced a method to increase the security of Android unlock patterns, called Double Patterns, allowing users to choose two sequential, superimposed patterns as their unlock pattern.

Intuitively, phone unlock schemes are a kind of pure graphical password [39], or a hybrid GP scheme (e.g., map-based GP [31, 36]). Many research studies are attempting to enhance the security of unlock schemes by considering a background image, for instance, *RouteMap* [24] needs a user to select a region on a world map and create a route based on their prior experience. Similarly, *PassMap* [40] requires a user to choose two location points on a world map, and *GeoPass* [42] then reduces the location number to only one.

## 2.2 Touch Behavioral Authentication

With the touchscreen being popular, user authentication based on touch dynamics becomes an important topic. To investigate the feasibility, Fen et al. [7] designed an authentication scheme by verifying the finger gesture. With a random forest algorithm, their scheme could achieve a false acceptance rate of 4.66% and a false rejection rate of 0.13%. Meanwhile, Meng et al. [21] focused on the same challenge, and developed a touch dynamics-based authentication scheme with 21 features. With a hybrid classifier of PSO-RBFN, their scheme could reach an average error rate of 3%. Frank et al. [9] then introduced a similar
behavioral authentication scheme with 30 features, which could reach a median equal error rate of around 4%.

With the increasing capability of touchscreen, multi-touch actions receive more attention. Meng et al. [22] developed a scheme called CD-GPS, which combined multi-touch actions in graphical password creation. It is found that multi-touch behavior could benefit the authentication process and increase the cracking difficulty. Zheng et al. [48] then combined tapping actions with passcode input. In the study, they considered the one-class classifier and achieved an averaged equal error rate of nearly 3.65%. Sharma and Enbody [38] studied users' touch behavior when playing with applications. With an ensemble classifier based on SVM, their scheme could provide a mean equal error rate of 7%. Li et al. [19] developed a type of simple shape-based behavioral authentication, where a user needs to draw different shapes during the verification. Five common shapes were considered: circle, square, rectangle, triangle and diamond. In the evaluation, they explored the performance between one-shape, two-shape and three-shape schemes, and found that two-shape scheme could be adopted by majority of participants. Shahzad et al. [37] presented an authentication scheme by studying how a user inputs a gesture in terms of velocity, device acceleration, and stroke time. They found that these features could be used for verifying a user. How to protect a password input is also an interesting question. Li et al. [15, 16] focused on this question and presented three practical anti-eavesdropping password entry schemes on stand-alone smart glasses, named gTapper, gRotator and gTalker. Some more behavioral authentication schemes can be referred to [20, 32, 33] and several surveys [11, 23].

## 3 Our Proposed Scheme

In the literature, many research studies are working on the security enhancement of phone unlock schemes, especially Android unlock patterns, by integrating with touch behavioral authentication. Motivated by this trend, in this work, we focus on improving the security of Android unlock patterns and introduce a double-cross-based unlock scheme (called Double-X), which allows phone users to input two cross shapes on two dots within the 3×3 grid. Figure 1 describes the scheme design with two steps: 1) selecting the first dot and drawing the cross shape, and 2) selecting the second dot and inputting the second cross shape.

- **Double-X registration.** As shown in Fig. 1, in order to register a credential, users have to follow the two steps to select two dots and draw two cross shapes. It is worth noting that our current scheme allows users to select the same dot and draw two cross shapes. The motivation behind is that our scheme can enhance the security by verifying the touch behavioral features. It is believed that users can draw the cross shapes in different ways, even on the same dot location.

- **Double-X authentication.** To unlock the phone, users need to select the same dots and draw the cross shapes in the same way when they create the
<figure><img src="image_3.png" /><figcaption>**Fig. 1.** Double-X unlock scheme: (1) Step 1: select one dot from the grid and draw a cross shape; and (2) Step 2: choose another dot from the grid and draw another cross shape.</figcaption></figure>

credential. A successful trial requires to verify both the dot location and how users draw the cross shapes, e.g., behavioral features. An algorithm then can be used to judge whether the current input is authenticated.

***Scheme Implementation.*** Figure 2 depicts an implementation of our designed Double-X scheme. In the first step, users will be guided to select one dot from the grid and draw the first cross shape. Then in the second step, users will be asked to choose the second dot and draw another cross shape. For usability, we set the error tolerance to a 21 × 21 pixel box around the dot location, where the tolerance value is selected based on the previous work [17,31]. As shown in Fig. 3(b), there are many ways to draw a cross shape, i.e., from top to bottom or versus, and the cross angles can be distinct among users. All these behavioral differences can be utilized to differentiate phone users.

To determine whether the current user is legitimate, our scheme has to verify the dot selection and the touch behavior when drawing the two cross shapes. For dot location, we can compare the current dot with the stored location by considering the error tolerance. To verify touch behavior, our current scheme uses machine learning techniques to help model the touch dynamics and make a decision. Several typical machine learning algorithms are considered in our scheme, such as support vector machine (SVM), decision tree, K-Nearest Neighbors (KNN) and neural networks.

***Feature Selection for Double-X.*** Touch behavioral verification is the key for our unlock scheme. To draw a cross shape, users have to perform touch movement on their phone touchscreen. In this case, our current scheme considers some typical and popular behavioral features regarding touch movement. As shown in Fig. 3(a), we separate a 2D plane into four directions: up, down, left and right. Then we can use an angle value of $d$ to describe the direction of a touch movement.
<figure><img src="image_4.png" /><figcaption>Fig. 2. An implementation of our designed Double-X scheme in the user study.</figcaption></figure>

Similar to the former study [26], we mainly consider two features to represent a touch movement: touch movement speed (TMS) and touch movement angle (TMA). If a touch movement starts at coordinate (x1, y1) and ends at coordinate (x2, y2), suppose the event system time is $S1$ and $S2$, then we can use the following equations to calculate the speed ($TMS1 - TMS4$) and the angle ($TMA1 - TMA4$) of four touch-movement inputs.

$$TMS = \frac{\sqrt{(x2 - x1)^2 + (y2 - y1)^2}}{S2 - S1} \qquad (1)$$

$$TMA (d) = \arctan \frac{y2 - y1}{x2 - x1}, \theta \in [0, 360^{\circ}] \qquad (2)$$

Moreover, our scheme also considers some more features such as the time difference between two touch movement actions when drawing a cross shape, touch pressure, and touch acceleration. The coordinates of touches would be examined by location matching process.

- *Time difference between two touch movement actions within a cross shape.* Our scheme records the time difference between the first touch movement and the second touch movement. Intuitively, the time difference should be varied among users.

- *Touch pressure.* Most smartphones are able to record touch pressure values, which can be utilized to model a user's touch behavior.

- *Touch acceleration.* Similar to the previous work [48], our work also considers touch acceleration with three vectors, such as the magnitude of acceleration when the touch is pressed down; the magnitude of acceleration when the touch is released; and the average value of magnitude of acceleration during touch-press to touch-release.
<figure><img src="image_5.png" /><figcaption>**Fig. 3.** (a) The directions on a 2D plane, and (b) several examples of drawing different cross shapes on a dot.</figcaption></figure>

## 4 User Study

In this section, in order to investigate the performance of Double-X, we conduct two IRB-approved user studies with a total of 80 common phone users, including 80% Android phone users and 20% iPhone & Android phone users (currently using both types of phones). Android phone (Samsung Galaxy Note) was used in our study. In the first study, we randomly selected 20 students to evaluate the classifier performance under Double-X, and the second user study aims to evaluate our scheme performance compared with similar unlock schemes.

Table 1 summarizes the information of occupation and age for all participants. In particular, we have 43 males and 37 females who aged from 19 to 55, including bachelor/master students, business people, university staff and faculty members. Each participant can get a $50 gift voucher after the user study.

<table><caption>**Table 1.** Participants' information in the user study.</caption><thead><tr><th>Information</th><th>Male</th><th>Female</th><th>Occupation</th><th>Male</th><th>Female</th></tr></thead><tbody><tr><td>Age &lt;25</td><td>30</td><td>25</td><td>Bachelor &amp; master students</td><td>36</td><td>29</td></tr><tr><td>Age 25-35</td><td>10</td><td>8</td><td>University faculty &amp; staff</td><td>5</td><td>5</td></tr><tr><td>Age 35-50</td><td>3</td><td>4</td><td>Business people</td><td>2</td><td>3</td></tr></tbody></table>

For the performance comparison, we select two similar schemes: *DeLucaUnLock scheme* [6] and *Double Patterns* [10]. The selection is due to their popularity and reported performance. As introduced earlier, DeLucaUnLock scheme combines the original Android unlock patterns with touch dynamics, by considering
behavioral features and performing a match via dynamic time warping (DTW). Double Patterns scheme [10] allows a user to choose two patterns entered one- after-the-other on the same 3 × 3 grid.

## 4.1 First Study on Classifier Performance

*Supervised Machine Learning.* Similar to previous research [17, 19], in this study, we mainly consider five typical supervised learning algorithms that have been realized on smartphones, such as Decision tree (J48), Naive Bayes, support vector machine (SVM), K-nearest neighbours (IBK) and Back Propagation Neural Network (BPNN).

To avoid implementation bias, all the algorithms were extracted from the WEKA platform [44], which is an open-source machine learning platform written in Java. For performance evaluation, we selected the default settings for all classifiers and adopted two common metrics as follows.

- False Acceptance Rate (FAR) indicates the rate of how many intruders are classified as legitimate users.

- False Rejection Rate (FRR) indicates the rate of how many legitimate users are classified as intruders.

*Classifier Evaluation.* To explore the classifier performance for our designed Double-X, we first randomly selected 20 students to create their credentials and then authenticate themselves with 400 trials (20 trials per student). Similar to several research studies, e.g., [17], we used 60% of trials as training data and the rest as testing data. Table 2 indicates the performance of different classifiers with a 10-fold cross-validation mode.

It is found that SVM could outperform other classifiers, i.e., it could achieve an average error rate (AER) of 4.35%, as compared with J48 8.35%, NBayes 12.65%, IBK 8.3%, and BPNN 8.05%. Therefore, our unlock scheme of Double-X would use SVM for user authentication in the second study.

<table><caption>**Table 2.** The authentication performance of different classifiers.</caption><thead><tr><th>Metric</th><th>J48</th><th>NBayes</th><th>SVM</th><th>IBK (k = 3)</th><th>BPNN</th></tr></thead><tbody><tr><td>FAR (%)</td><td>7.8</td><td>12.1</td><td>4.1</td><td>8.4</td><td>8.2</td></tr><tr><td>FRR (%)</td><td>8.9</td><td>13.2</td><td>4.6</td><td>8.2</td><td>7.9</td></tr><tr><td>AER (%)</td><td>8.35</td><td>12.65</td><td>4.35</td><td>8.30</td><td>8.05</td></tr></tbody></table>

## 4.2 The Second Study on Scheme Performance

*Study Steps.* Excluding 20 students in the first study, we randomly separated the remaining participants into two groups (30 participants per group): Group-1 focuses on DeLucaUnLock scheme and our scheme of Double-X, while Group-2
<table><caption>**Table 3.** Success rate in the confirmation, login and retention phase for Group-1.</caption><thead><tr><td>Phase</td><td>DeLucaUnLock scheme</td><td>Double-X scheme</td></tr></thead><tbody><tr><td>Confirmation</td><td>282/300 (94.0%)</td><td>283/300 (94.3%)</td></tr><tr><td>Login</td><td>288/300 (96.0%)</td><td>286/300 (95.3%)</td></tr><tr><td>Retention</td><td>277/300 (92.3%)</td><td>281/300 (93.7%)</td></tr></tbody></table>

focuses on Double Patterns and our scheme of Double-X. For each group, the starting sequence would be random, which means participants may start from either DeLucaUnLock scheme, Double Patterns or Double-X.

Before the study, we provided an explanation about our objectives and what kind of data would be collected and stored. We also prepared a set of guidelines for all participants to follow and a consent form would be collected as well. In addition, each participant would have three trials to get familiar with the scheme and address any confusion. All participants then would perform the study in our lab environment. The detailed study steps are shown as below.

- Step 1. Creation phase: participants need to register their credentials according to the respective scheme (e.g., DeLucaUnLock, Double Patterns and Double-X).

- Step 2. Confirmation phase: participants have to confirm the credentials by verifying dot location and touch behavior for 10 times. Participants can change their credentials if they fail or want to create a new one.

- Step 3. Distributed memory: participants are given one paper-based finding task to distract them for 15 min.

- Step 4. Login phase: participants should unlock the phone with their credentials for 10 trials.

- Step 5. Feedback form: participants are provided with a set of questions (*feed-back from*) regarding the scheme usage.

- Step 6. Retention. After three days, participants are invited to unlock the phone for 10 times in our lab.

- Step 7. Participants are provided with another *feedback from* regarding the scheme usage.

**Study Results.** During the study, we could collect 300 trials in the confirmation, the login and the retention phase. It is the same that we used 60% of trials as training data and the rest as testing data. We adopted Chi-square tests to judge whether the results are statistically significant between two conditions. Table 3 and Table 4 describe the success rate for confirmation, login and retention phase under two groups, respectively.

- *Confirmation phase.* For Group-1, participants could reach a success rate of 94% vs. 94.3% under DeLucaUnLock Scheme and Double-X, respectively. The errors for both schemes were mainly caused during the verification of behavioral features: 1) a touch movement action is faster or slower than the pre-built normal profile, and 2) for Double-X, the touch direction was not
<table><caption>**Table 4.** Success rate in the confirmation, login and retention phase for Group-2.</caption><thead><tr><td>Phase</td><td>Double patterns</td><td>Double-X scheme</td></tr></thead><tbody><tr><td>Confirmation</td><td>277/300 (92.3%)</td><td>281/300 (93.7%)</td></tr><tr><td>Login</td><td>289/300 (96.3%)</td><td>287/300 (95.6%)</td></tr><tr><td>Retention</td><td>271/300 (90.3%)</td><td>283/300 (94.3%)</td></tr></tbody></table>

<table><caption>**Table 5.** Time consumption in the login for different groups.</caption><thead><tr><td>Unlock scheme</td><td>DeLucaUnLock</td><td>Double-X</td><td>Double patterns</td></tr></thead><tbody><tr><td>Time consumption (s)</td><td>3.8</td><td>4.2</td><td>5.1</td></tr><tr><td>Standard deviation (s)</td><td>1.5</td><td>2.1</td><td>3.4</td></tr></tbody></table>

matched. For Group-2, participants could achieve a success rate of 92.3% and 93.7% for Double Patterns and Double-X, respectively. The errors made under Double-X were similar to Group-1, while the errors made under Double Patterns were mainly caused by inputting a wrong pattern, especially for the second pattern. Overall, there is no statistically significant difference regarding the success rate for two groups.

- *Login phase.* In this phase, for Group-1, participants could perform well with a success rate of 96% and 95.3% under DeLucaUnLock Scheme and Double-X. While participants in Group-2 could provide a success rate of 96.3% and 95.6% for Double Patterns and Double-X. The errors made were similar to the confirmation phase. There is no statistically significant difference regarding the success rate for two groups.

- *Retention phase.* After Step 5, we invited all participants to come back to our lab in three days, and only 5 of them were failed. For retention phase, participants could achieve a success rate of 92.3% and 93.7% under DeLucaUnLock Scheme and Double-X for Group-1, and 90.3% and 94.3% under Double Patterns and Double-X for Group-2. The authentication rate is positive as there is only a small decrease as compared with the rates in the login phase. It is interesting to identify that Double-X can provide a much better success rate than Double Patterns, and there is a statistically significant difference.

The above success rates indicate that all these unlock schemes are usable. To further explore the scheme usage, Table 5 shows the time consumption for each scheme. It is seen that DeLucaUnLock scheme required less time than the other schemes. This result is very easy to understand because it is a one-step scheme. For two-step scheme between Double Patterns and Double-X, it is found that participants only need around 4.2 s for Double-X, but required 5.1 s for Double Patterns. This is because participants have to recall the patterns they created under Double Patterns, whereas it is much easier to remember a cross shape. It is the same to the standard deviation, whereby Double-X could have a smaller deviation than Double Patterns.
<table><caption>**Table 6.** Major questions and average scores from the participants.</caption><thead><tr><th>Questions (Group-1)</th><th>Average scores</th></tr></thead><tbody><tr><td>1. I could easily create a password under DeLucaUnLock scheme</td><td>9.1</td></tr><tr><td>2. I could easily create a password under Double-X scheme</td><td>9.2</td></tr><tr><td>3. The time consumption for DeLucaUnLock scheme is acceptable</td><td>9.2</td></tr><tr><td>4. The time consumption for Double-X scheme is acceptable</td><td>9.1</td></tr><tr><td>5. I could easily login to DeLucaUnLock scheme</td><td>8.8</td></tr><tr><td>6. I could easily login to Double-X scheme</td><td>8.7</td></tr><tr><td>7. I could remember DeLucaUnLock credentials easily</td><td>8.6</td></tr><tr><td>8. I could remember Double-X credentials easily</td><td>8.8</td></tr><tr><td>9. I think DeLucaUnLock scheme is more secure than Double-X scheme</td><td>3.8</td></tr></tbody><thead><tr><th>Questions (Group-2)</th><th>Average scores</th></tr></thead><tbody><tr><td>1. I could easily create a password under Double Patterns scheme</td><td>8.6</td></tr><tr><td>2. I could easily create a password under Double-X scheme</td><td>9.0</td></tr><tr><td>3. The time consumption for Double Patterns scheme is acceptable</td><td>8.3</td></tr><tr><td>4. The time consumption for Double-X scheme is acceptable</td><td>8.9</td></tr><tr><td>5. I could easily login to Double Patterns scheme</td><td>8.8</td></tr><tr><td>6. I could easily login to Double-X scheme</td><td>9.0</td></tr><tr><td>7. I could remember Double Patterns credentials easily</td><td>8.2</td></tr><tr><td>8. I could remember Double-X credentials easily</td><td>9.0</td></tr><tr><td>9. I think Double Patterns scheme is more secure than Double-X scheme</td><td>4.3</td></tr></tbody></table>

**User Feedback.** In the user study, two feedback forms were provided to each participant regarding the scheme usage, in the aspects of both security and usability. Ten-point Likert scales were used for each question, where 1-score indicates strong disagreement and 10-score indicates strong agreement. The major questions and scores are shown in Table 6.

- *Group-1.* For the credential creation, most participants believed that both DeLucaUnLock and Double-X are easy to use, with an average score of 9.1 vs. 9.2, respectively. For the time consumption, both schemes were satisfied with most participants. For login process, most participants advocated the easy usage for both schemes with 8.8 and 8.7 each. For memory capability, Double-X received a higher score of 8.8 compared with 8.6 for DeLucaUnLock scheme. For the security aspect, most participants believed that our scheme of Double-X is more secure, as it is a two-step unlock scheme, which should be able to increase the cracking difficulty.

- *Group-2.* Regarding the credential creation, Double-X received a higher score of 9.0 than the score of 8.6 from Double Patterns. This is because participants have to remember two patterns under Double Patterns, but the memory load is much lower under Double-X. This is the main reason why most participants considered it is easier to remember Double-X credentials, i.e., Double-X: 9.0 vs. Double Patterns: 8.2. For the time consumption, Double-X also received a
higher score of 8.9 versus 8.3 for Double Patterns, where the result is in-line
with Table 5. For login process, both schemes were considered to be usable
with a score of 8.8 and 9.0 for Double Patterns and Double-X. For the security
aspect, most participants considered Double-X is more secure due to the
involvement of behavior verification.

According to the collected feedback, most participants in Group-1 believed
that DeLucaUnLock and Double-X scheme can have similar usability, but
Double-X is more secure by selecting two dots and drawing two cross shapes.
In Group-2, most participants considered Double-X is more usable and secure
than Double Patterns. The main reason is that Double Patterns scheme requires
users to remember two patterns while Double-X can ease the memory burden
and integrate touch behavioral features. Overall, our results indicate the viability
and positive performance of Double-X.

## 4.3 Limitation and Discussion

In the evaluation, we performed two user studies to explore the classifier selection and the scheme performance. The results are positive, indicating the viability and usability of Double-X. As the scheme is still developing at an early stage, below are some challenges and limitations that could be investigated in future.

- *The number of participants.* In this study, we involved 20 participants for evaluating the classifier performance, and 60 participants for exploring the scheme performance. To verify the results, we plan to recruit more participants with diverse background.

- *Classifier selection.* In this work, we mainly consider some typical supervised algorithms, which can be deployed in a smart device. Intuitively, there are many other algorithms, and our future work plans to consider more advanced learning algorithms like deep learning.

- *Security and attacks.* Based on the feedback, most participants believed that Double-X is more secure than DeLucaUnLock scheme and Double Patterns, but we did not evaluate the scheme under adversarial scenarios and attacks. In our next work, we plan to focus on the security aspect and explore the scheme performance under some typical attacks, e.g., mimic attack.

- *Dot selection.* In our current scheme, we allow users to select the same dot for inputting the cross shapes. It is an interesting topic to explore the scheme performance if we only allow users to select different dots. In addition, it is also an interesting and important topic to study whether there is a dot-selection bias.

# 5 Conclusion

Phone unlock mechanisms are a basic and important security solution to pro-
tect smartphones from unauthorized access and authenticate legitimate users.
Android unlock patterns are a typical and popular unlock mechanism on Android phones, allowing users to draw a pattern on the 3 × 3 grid. However, such unlock mechanism is still vulnerable to various attacks. In this work, we advocate the integration of touch behavioral features, and design Double-X, a double-cross-based unlock mechanism that requires users to draw two cross shapes by selecting two dots. For evaluation, we performed two user studies: the first one explored the classifier performance and selected SVM to be deployed in Double-X; and the second one investigated the scheme performance of Double-X, compared with two similar unlock schemes of DeLucaUnLock and Double Patterns. It is found that participants under Double-X could provide a success rate of around 95% in login and retention phase. In addition, most participants believed that Double-X is more secure than the other two schemes.

**Acknowledgments.** We would like to thank all the participants for their hard work in the user study.

## References

1. Smartphone Shipments Declined in the Fourth Quarter But 2021 Was Still a Growth Year with a 5.7% Increase in Shipments. https://www.idc.com/getdoc.jsp?containerId=prUS48830822

2. February 2022 Mobile User Statistics. https://www.bankmycell.com/blog/how-many-phones-are-in-the-world

3. Aviv, A.J., Gibson, K., Mossop, E., Blaze, M., Smith, J. M.: Smudge attacks on smartphone touch screens. In: Proceedings of the 4th USENIX Conference on Offensive Technologies, pp. 1–7, USENIX Association (2010)

4. Al-Sudani, A.R., Gao, S., Wen, S., Al-Khiza'ay, M.: Checking an authentication of person depends on RFID with thermal image. In: Wang, G., Chen, J., Yang, L.T. (eds.) SpaCCS 2018. LNCS, vol. 11342, pp. 371–380. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-05345-1_32

5. Bonneau, J.: The science of guessing: analyzing an anonymized corpus of 70 million passwords. In: Proceedings of the 2012 IEEE Symposium on Security and Privacy, pp. 538–552 (2012)

6. De Luca, A., Hang, A., Brudy, F., Lindner, C., Hussmann, H.: Touch me once and i know it's you!: implicit authentication based on touch screen patterns. In: Proceedings of CHI (ACM), pp. 987–996 (2012)

7. Feng, T., et al.: Continuous mobile authentication using touchscreen gestures. In: Proceedings of the 2012 IEEE Conference on Technologies for Homeland Security (HST), pp. 451–456. IEEE (2012)

8. Findling, R.D., Mayrhofer, R.: Towards face unlock: on the difficulty of reliably detecting faces on mobile phones. MoMM, pp. 275–280 (2012)

9. Frank, M., Biedert, R., Ma, E., Martinovic, I., Song, D.: Touchalytics: on the applicability of touchscreen input as a behavioral biometric for continuous authentication. IEEE Trans. Inf. Forensics Secur. 8(1), 136–148 (2013)

10. Forman, T., Aviv, A.: Double patterns: a usable solution to increase the security of android unlock patterns. ACSAC, pp. 219–233 (2020)
11. Gomez-Barrero, M., Galbally, J.: Reversing the irreversible: a survey on inverse biometrics. Comput. Secur. 90, 101700 (2020)

12. Guo, Y., Yang, L., Ding, X., Han, J., Liu, Y.: OpenSesame: unlocking smart phone through handshaking biometrics. INFOCOM, pp. 365–369 (2013)

13. Izuta, R., Murao, K., Terada, T., Iso, T., Inamura, H., Tsukamoto, M.: Screen unlocking method using behavioral characteristics when taking mobile phone from pocket. MoMM, pp. 110–114 (2016)

14. Larrucea, X., Moffie, M., Asaf, S., Santamaria, I.: Towards a GDPR compliant way to secure European cross border healthcare industry 4.0. Comput. Stand. Interfaces 69, 103408 (2020)

15. Li, Y., et al.: A closer look tells more: a facial distortion based liveness detection for face authentication. AsiaCCS, pp. 241–246 (2019)

16. Li, Y., Cheng, Y., Meng, W., Li, Y., Deng, R.H.: Designing leakage-resilient password entry on head-mounted smart wearable glass devices. IEEE Trans. Inf. Forensics Secur. 16, 307–321 (2021)

17. Li, W., Tan, J., Meng, W., Wang, Yu., Li, J.: SwipeVLock: a supervised unlocking mechanism based on swipe behavior on smartphones. In: Chen, X., Huang, X., Zhang, J. (eds.) ML4CS 2019. LNCS, vol. 11806, pp. 140–153. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-30619-9_11

18. Li, W., Tan, J., Meng, W., Wang, Y.: A swipe-based unlocking mechanism with supervised learning on smartphones: design and evaluation. J. Netw. Comput. Appl. 165, 102687 (2020)

19. Li, W., Wang, Y., Li, J., Xiang, Y.: Towards supervised shape-based behavioral authentication on smartphones. J. Inf. Secur. Appl. 55, 102591 (2020)

20. Liang, Y., Samtani, S., Guo, B., Yu, Z.: Behavioral biometrics for continuous authentication in the internet-of-things era: an artificial intelligence perspective. IEEE Internet Things J. 7(9), 9128–9143 (2020)

21. Meng, Y.: Designing click-draw based graphical password scheme for better authentication. In: Proceedings of the 7th IEEE International Conference on Networking, Architecture, and Storage (NAS), pp. 39–48 (2012)

22. Meng, Y., Li, W., Kwok, L.-F.: Enhancing click-draw based graphical passwords using multi-touch on mobile phones. In: Janczewski, L.J., Wolfe, H.B., Shenoi, S. (eds.) SEC 2013. IAICT, vol. 405, pp. 55–68. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-39218-4_5

23. Meng, W., Wong, D.S., Furnell, S., Zhou, J.: Surveying the development of biometric user authentication on mobile phones. IEEE Commun. Surv. Tutor. 17(3), 1268–1293 (2015)

24. Meng, W.: RouteMap: a route and map based graphical password scheme for better multiple password memory. In: NSS 2015. LNCS, vol. 9408, pp. 147–161. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-25645-0_10

25. Meng, W.: Evaluating the effect of multi-touch behaviours on android unlock patterns. Inf. Comput. Secur. 24(3), 277–287 (2016)

26. Meng, W., Li, W., Wong, D.S., Zhou, J.: TMGuard: a touch movement-based security mechanism for screen unlock patterns on smartphones. In: Manulis, M., Sadeghi, A.-R., Schneider, S. (eds.) ACNS 2016. LNCS, vol. 9696, pp. 629–647. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-39555-5_34

27. Meng, W., Lee, W.H., Liu, Z., Su, C., Li, Y.: Evaluating the impact of juice filming charging attack in practical environments. In: Kim, H., Kim, D.-C. (eds.) ICISC 2017. LNCS, vol. 10779, pp. 327–338. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-78556-1_18
28. Meng, W., Fei, F., Li, W., Au, M.H.: Harvesting smartphone privacy through enhanced juice filming charging attacks. In: Nguyen, P., Zhou, J. (eds.) Information Security. ISC 2017. LNCS, vol. 10599. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-69659-1_16

29. Meng, W., Li, W., Kwok, L.-F., Choo, K.-R.K.: Towards enhancing click-draw based graphical passwords using multi-touch behaviours on smartphones. Comput. Secur. 65, 213–229 (2017)

30. Meng, W., Li, W., Lee, W.H., Jiang, L., Zhou, J.: A pilot study of multiple password interference between text and map-based passwords. In: Gollmann, D., Miyaji, A., Kikuchi, H. (eds.) ACNS 2017. LNCS, vol. 10355, pp. 145–162. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-61204-1_8

31. Meng, W., Lee, W.H., Au, M.H., Liu, Z.: Exploring effect of location number on map-based graphical password authentication. In: Pieprzyk, J., Suriadi, S. (eds.) ACISP 2017. LNCS, vol. 10343, pp. 301–313. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-59870-3_17

32. Meng, W., Li, W., Wong, D.S.: Enhancing touch behavioral authentication via cost-based intelligent mechanism on smartphones. Multimed. Tools Appl. 77(23), 30167–30185 (2018). https://doi.org/10.1007/s11042-018-6094-2

33. Meng, W., Wang, Y., Wong, D.S., Wen, S., Xiang, Y.: TouchWB: touch behavioral user authentication based on web browsing on smartphones. J. Netw. Comput. Appl. 117, 1–9 (2018)

34. Nyang, D., et al.: Two-Thumbs-Up: physical protection for PIN entry secure against recording attacks. Comput. Secur. 78, 1–15 (2018)

35. Shepard, R.N.: Recognition memory for words, sentences, and pictures. J. Verbal Learn. Verbal Behav. 6(1), 156–163 (1967)

36. Spitzer, J., Singh, C., Schweitzer, D.: A security class project in graphical passwords. J. Comput. Sci. Coll. 26(2), 7–13 (2010)

37. Shahzad, M., Liu, A.X., Samuel, A.: Behavior based human authentication on touch screen devices using gestures and signatures. IEEE Trans. Mob. Comput. 16(10), 2726–2741 (2017)

38. Sharma, V., Enbody, R.: User authentication and identification from user interface interactions on touch-enabled devices. In: Proceedings of the 10th ACM Conference on Security and Privacy in Wireless and Mobile Networks (WiSec), pp. 1–11 (2017)

39. Suo, X., Zhu, Y., Owen, G.S.: Graphical passwords: a survey. In: Proceedings of the 21st Annual Computer Security Applications Conference (ACSAC), pp. 463–472. IEEE (2005)

40. Sun, H., Chen, Y., Fang, C., Chang, S.: PassMap: a map based graphical-password authentication system. In: Proceedings of AsiaCCS, pp. 99–100 (2012)

41. Tao, H., Adams, C.: Pass-Go: a proposal to improve the usability of graphical passwords. Int. J. Netw. Secur. 2(7), 273–292 (2008)

42. Thorpe, J., MacRae, B., Salehi-Abari, A.: Usability and security evaluation of GeoPass: a geographic location-password scheme. In: Proceedings of the 9th Symposium on Usable Privacy and Security (SOUPS), pp. 1–14 (2013)

43. Wang, L., et al.: Unlock with your heart: heartbeat-based authentication on commercial mobile phones. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 2(3), 140:1–140:22 (2018)

44. WEKA: machine learning software in Java. https://www.cs.waikato.ac.nz/ml/weka/

45. Wiedenbeck, S., Waters, J., Birget, J.-C., Brodskiy, A., Memon, N.: PassPoints: design and longitudinal evaluation of a graphical password system. Int. J. Hum Comput Stud. 63(1–2), 102–127 (2005)
46. Weir, M., Aggarwal, S., Collins, M., Stern, H.: Testing metrics for password creation policies by attacking large sets of revealed passwords. In: Proceedings of CCS, pp. 162–175 (2010)

47. Yi, S., Qin, Z., Carter, N., Li, Q.: WearLock: unlocking your phone via acoustics using smartwatch. ICDCS, pp. 469–479 (2017)

48. Zheng, N., Bai, K., Huang, H., Wang, H.: You are how you touch: user verification on smartphones via tapping behaviors. In: Proceedings of the 2014 International Conference on Network Protocols (ICNP), pp. 221–232 (2014)