Haptic experience and the design of drawing interfaces Haptic feedback has the potential to enhance users' sense of being engaged and creative in their artwork. Current work on providing haptic feedback in computer-based drawing applications has focused mainly on the realism of the haptic sensation rather than the users' experience of that sensation in the context of their creative work. We present a study that focuses on user experience of three haptic drawing interfaces. These interfaces were based on two different haptic metaphors, one of which mimicked familiar drawing tools (such as pen, pencil or crayon on smooth or rough paper) and the other of which drew on abstract descriptors of haptic experience (roughness, stickiness, scratchiness and smoothness). It was found that users valued having control over the haptic sensation; that each metaphor was preferred by approximately half of the participants; and that the real-world metaphor interface was considered more helpful than the abstract one, whereas the abstract interface was considered to better support creativity. This suggests that future interfaces for artistic work should have user-modifiable interaction styles for controlling the haptic sensation. Matisse, when working on his paper cutouts was reported by Guichard~Meili (1984) to have said: "Just feel it! … It took a lot of research and many experiments to find it. I can become totally absorbed in working on this paper with scissors …" This illustrates the importance of haptic sensation in creative activities, and its potentially positive effect on the user. It also suggests that an understanding of users' subjective experience could guide the design of haptic feedback in an artwork system.. Haptic interfaces in art-related applications have been reported as being able to improve users' performances and enhance their creative processes (Baxter et al., 2001; Kim et al, 2003; Shillito et al., 2001; Yeh, et al., 2002) . However, work to date has focused on the realism of the haptic sensation, rather than on understanding the role of haptic feedback in creating a positive user experience for art-related applications, or on how users might choose between alternative haptic sensations in interactions.. In this paper we focus on user haptic experience in drawing. We examine current work that involves haptic sensation in drawing-related applications and identify ways to represent those sensations in interface designs, with a view to supporting the creativity of users. We present a study whose findings revolve around users' preferences and experiences of haptic feedback, considering in particular the role of haptic metaphors in supporting the interaction between users and drawing system. Past work on haptic interactions has generally focused on implementation details and accurate haptic rendering. Our work has taken a different focus, namely on the user's interaction experience, on whether user controllable haptic feedback is valued by artists in a drawing tool, and on how to support user control at the interface.. The two interface metaphors implemented were liked approximately equally, but for different reasons. The haptic interface implementing a real world metaphor was valued for its familiarity, and was considered helpful. In contrast, the abstract metaphor interface was considered to better support creativity. However, some participants found it harder to understand. They also found it difficult to remember which combinations of stickiness, bumpiness and scratchiness they preferred. Within the two interfaces where the user could control the haptic sensation, there was no single preferred sensation, though ones for which there was a real-world analogue (not necessarily explicit in the metaphor) were generally preferred to those with less familiar sensations. These findings show that an interface that combines both metaphors, allowing users to work with analogues of real-world tools, to work directly with the abstract haptic dimensions or to define their own tools in terms of those dimensions, would be a promising design solution.. The fact that haptic feedback was the focus of this research project has made the visual features secondary to the work. To address this matter, future studies should include the role of the visual feedback (and particularly the way visual and haptic feedback combine to create particular user experiences); the role of sound, orientation and other contextual factors that contribute to the overall user experience; and the details of the designs of the user control (e.g. sliders would give greater control than buttons).. Overall, current haptic technologies are still relatively primitive (the PHANTOM has single point contact, is much more unwieldy than the typical pen or crayon, generates motor noise, etc.). Nevertheless, this study has provided evidence that haptic feedback can enhance artists' creative experience with computer-based drawing applications. Two different interface metaphors were found to give similarly positive experiences, and an interface that combined both would be a very promising design offering. The role of metaphor as a memory aid (Blackwell, 1998) has been applied in interface design. Reification of metaphor (Blackwell, 2006) can make the abstract haptic sensation from a drawing interaction concrete. During the evaluation, the artists utilised the visual metaphors presented on the interface to decide the tactile sensation that they preferred for a drawing interaction. The metaphor employed in the study influences the factors that affect user preference of tactile experience for a drawing application. Such factors are based on artists' familiarity with the real world interaction and user control, and a balance between a new experience and familiarity of the haptic sensation. The relevance of metaphor in presenting haptic information has led to a discussion of whether metaphor enhances or hinders user haptic experience in a drawing interaction. What suggestions would be appropriate to address the issues if metaphor hinders user experience? Haptic feedback is an aspect of the design of human-computer interactions that has potential to support user experience goals (MacLean, 2000) . The haptic sensation perceived could influence users' preferences, and hence their acceptance of a new system. This has prompted us to explore how haptic feedback has been, and should be, presented in order to satisfy user experience requirements (Preece et al., 2002) . 21 traditional artists took part in the study (13 females and 8 males). 2 of the artists paint for a living, while 15 were undergraduate and 4 were postgraduate students from the Slade School of Art at University College London. All the artists were interviewed and the conversations were audio recorded. During the interviews, the artists were given a collection of 9 pen-like tools (4 pens, 3 pencils, a crayon and charcoal, selected to represent a broad range of tactile experiences) to work with. They were asked to describe the tactile sensation and the visual appearance of each tool whilst holding it in their hands. Using the tool, they were asked to do free drawing or writing on two different types of textured paper. During their interactions, they were asked to talk aloud about the tactile sensation they experienced and the appearance of the mark produced when they drew with each tool on the paper. They were also encouraged to talk about any similar experiences using drawing tools in their daily work.. The recorded conversations were transcribed, and the vocabulary that was used by the artists was identified. These vocabularies were examined to identify the terms used by each artist across all the 9 pen-like tools and two paper types. From the vocabularies, any similar terms were grouped into the same category. The groups obtained were further classified based on the actions made by the artists, so as to determine at which stage of interaction a particular haptic cue should be applied in the interface design. To ensure consistency of the terms used by the artists when describing each tool, an orthogonal data analysis was performed. In this, the transcribed data was transformed into 9 different sets based on the tools used in the study. The terms used by all the 21 artists to describe the tactile sensations when using each tool were identified. These terms were cross-examined to assess their internal consistency. No major inconsistencies were found.. 24 traditional artists took part in the study (14 females and 10 males). 7 of the artists paint either for pleasure or for living, while the rest were students from the Slade School of Art at University College London (4 undergraduate and 13 postgraduate). All artists were paid for their participation. None of them had participated in any earlier studies. They were provided with training on using the PHANTOM before the study.. In the study, a counterbalanced repeated measures design was used. Each artist was given about 10 to 15 minutes to interact with the first interface. They were asked to do free drawing using the PHANTOM, and describe out loud the tactile sensation felt. They had to try all combinations on each interface (the researcher, using a mouse, did the combination changing at the user's request). Next, a debriefing session was conducted. The artists were asked which combination(s) they liked to interact with most and to give reasons for this choice. For example, the artists were asked for the pen-tool metaphor interface (Interface B): In terms of the tactile sensation, which of the pen-tool and paper type combinations do you prefer to use? And why? They were allowed to request any combinations they wished to try again to confirm their judgments of the haptic sensation in this preference exercise.. Next, the artists were given the second interface to evaluate. All procedures were replicated. Towards the end of the evaluation they were asked which of the two interfaces they preferred to interact with in terms of the tactile sensation and why. At this stage an interim preference was obtained.. Finally, the artists were given the third interface to evaluate; again, they were asked to try all combinations of cues available, and the same steps were followed. After the evaluation, the artists were asked for their preference between the previous interface that they preferred and the third interface, and their reasons for this. This preference was used as the inferred final preference in the study. In retrospect, this approach to questioning meant that in a small number of cases (where the interim and final preferences were the same), the relative preferences of the other two interfaces were not established, so that the final analysis is sometimes based on fewer than 24 data points (see below). This approach is taken since it is not our main intention to find out the best out of the three interfaces evaluated. Rather, this evaluation is more focusing on eliciting users' subjective experiences of the three interfaces in terms of the haptic feedback provided.. An overall debrief was conducted to rank the three interfaces based on the artist's preference in terms of the haptic feedback. User experience criteria based on Preece et al. (2002) were used for this debrief.. The interviews were transcribed verbatim from the audio recordings, yielding twenty-four data sets. The study resulted in both quantitative and qualitative data. The quantitative data consists of the artists' preference towards the interface, and ranking of interfaces with respect to user experience goal criteria and tactile cues during the interaction, while the qualitative includes the articulated reasons for such preferences, vocabularies used to describe the tactile sensation in Interface B, and any other remarks pertaining to the study that were voluntarily suggested by the artists during the evaluation. It should be noted that only a simple quantitative analysis such as counting the number of preferences was involved in this exercise. The main intention for this quantitative data is to provide a foundation for presenting the artists' subjective experience from the study. No statistical data on the ranking of the three interfaces was involved in the analysis. Qualitative findings whereby the reasons a particular haptic interface is preferred based on artists' perspectives provides a more appropriate assessment; this may limit generalisability of the study results.

O O O O O O O O B I O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O B I B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A type system extension for middleware interactions Object-oriented programming languages such as Java provides inadequate support for advanced method invocation strategies in distributed applications. Invocation semantics such as reliable unicast and multicast must be implemented based on primitive, unreliable unicast mechanisms such as Java RMI and Socket communication. This forces developers to devise ad hoc communication strategies, which is a repetitive and error-prone process. Moreover, these communication strategies are entangled with the business logic of the application, making the code hard to read and maintain.In this paper, we propose an extension of the Java type system based on communication qualifiers. These qualifiers decorate variables with information about the invocation semantics that must be used when methods are invoked on that variable. We show how communication qualifiers are used to support transparent multicast and reliable unicast invocation semantics in Java. Moreover, we introduce declarative operations to enable developers to fine-tune these communication strategies. The introduction of the Java API for Remote Method Invocation [1] is an attempt to bring the semantics of local method invocation to the world of distributed systems. Local method invocation relies on an implicit unicast communication strategy. The strategy is implicit because the invocation semantics cannot be altered by the programmer.. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. It is based on unicast because each method invocation o.m() is sent to exactly one receiver, namely the instance to which o refers. Although these semantics work fine for applications running on a local virtual machine, they become less appealing in a server architecture with replicated services 1 , where advanced invocation strategies like reliable unicast and multicast are frequently needed.. Reliable unicast is typically used to handle availability problems at the server side. Operations invoked on an unreachable service are reinvoked on one of the backup services until the request has been handled, or until the architecture runs out of backup services. In other words, reliable unicast semantics require the client to invoke an operation on any target from a group of compatible services. By relying on a single receiver invocation model, however, Java is unable to transparently support this feature, forcing developers to write code for explicitly rewiring the variable to a backup service and reinvoking the operation. The same problem occurs for multicast invocations, where an invocation must be sent to a all members of a group of services in stead of a single target.. In this paper, we present an approach based on communication qualifiers for altering method invocation semantics. Such a qualifier decorates a Java type and informs the middleware about the communication strategy that must be used when a method is invoked on that variable. Developers can fine-tune this strategy by using declarative operations, for instance, to enforce Quality of Service constraints on the members of a replicated service group. This paper is structured as follows. In Section 2, we enumerate a number of shortcomings related to remote method invocation in Java. In Section 3, we discuss basic properties of communication qualifiers. Section 4 shows how these qualifiers are used to support multicast semantics, whereas Section 5 discusses how they enable reliable unicast. Section 6 shows how the behaviour of the communication mechanism can be altered at runtime. Section 7 briefly discusses related work and Section 8 concludes. We have argued how communication qualifiers can be used to configure method invocation semantics in a declarative way. We have shown how the group qualifier is used to multicast method calls to a group of compatible services, and we have discussed how the pool and sequence qualifier are used for specifying a reliable unicast strategy. These communication strategies can be fine-tuned by means of declarative operations, such as where, orderby, all, and any.. Our type system extension enables programmers to imple-ment different remote invocation semantics at a higher level of abstraction (OO1) using language constructs to fine-tune their communication strategy (OO2). Moreover, by integrating communication qualifiers with the type system, the compiler is able to detect communication conflicts by analyzing the flow of those qualifiers through a program (OO3). We are currently working on a compiler prototype that transforms our language concepts to Java code. This guarantees interoperability with existing applications and it allows us to reuse the standard Java Virtual Machine for running applications enriched with communication qualifiers. Future work includes (1) a comparative study on how our concepts relate to and integrate with fragmented object systems, and (2) the specification and implementation of a more fine-grained model of communication qualifiers in order to support different communication strategies. Without support for multicast and reliable unicast, a programming language forces programmers to reify low-level details of the server architecture in their source code. Indeed, the semantics of these communication strategies rely on the existence of multiple (replicated) service endpoints, and references pointing to these endpoints must be explicitized in the source code before they can serve as backup invocation targets. This approach has a number of disadvantages:. • Abstraction. Algorithms supporting invocation semantics such as reliable unicast and multicast cooperate tightly with the business logic, thus obstructing a clean generalization into reusable libraries or aspects. Consequently, programmers have to implement ad hoc algorithms for supporting new communication strategies over and over again, leading to a very low level of abstraction.. • Program Comprehension. The code of these ad hoc communication protocols obfuscates the business logic and decreases the modularity of the source code, which in turn increases maintenance costs as well as the probability to introduce bugs in newer versions of the software.. • Flexibility. References pointing to replicas of a remote service must be managed in the source code, which increases the number of hardcoded references to physical service locations. This causes problems when services are migrated to other servers, it disables the discovery of newly added replicas, and it introduces problems when the application is reused in another server architecture. The approach proposed in this paper advocates a different communication model, which is aimed at realizing three objectives related to object-oriented software development:. • OO1 -Abstraction. The plurality of replicated services must be hidden for application developers. Instead, they should invoke operations on a logical target without having to manage the underlying group of physical targets. Also, the algorithms that implement the required communication strategy must be hidden.. • OO2 -Configurability. Even though the details of a communication strategy must be hidden to increase the level of abstraction, the behaviour of those algorithms must be configurable by developers in order to customize the semantics of method invocation to the specific needs of an application.. • OO3 -Compile-time Analysis. A compiler must be able to analyze the flow of a communication strategy throughout the application in order to avoid communication conflicts. An example of such a conflict is an assignment of a unicast reference to a variable that requires a multicast method invocation protocol. A large number of Java frameworks and language extensions have been proposed in order to extend Java with support for communication strategies other than the basic unreliable unicast mechanism of RMI. In this Section, we relate our proposal with (1) Java libraries and frameworks, (2) Java language extensions, and (3) approaches based on design patterns.. Libraries and Frameworks. Java libraries such as GMI [11] and ProActive [3] support multicast invocation and fault tolerance, but they force the programmer to explicitize the underlying server architecture. Using ProActive, for example, developers must write code for creating groups and adding group members, leading to a lower level of abstraction (OO1). Moreover, these libraries rely on a Meta-Object Protocol and inherit its limitations, such as the inability to invoke operations with a primitive return type or operations returning final classes.. Similar problems were found in OpusJava [10] , a Java framework for distributed computing with support for remote object creation and asynchronous method invocation.. The strength of OpusJava is that it allows to change the invocation semantics at the level of a single method invocation. It does so by offering methods such as call(methodName,arguments). By relying on reflection, however, OpusJava bypasses compile-time checks (OO3) on the method call. Indeed, by passing method names (methodName) as String objects, the compiler is unable to guarantee that the target object actually exports that method. Similarly, the compiler cannot check whether the argument list (arguments) conforms to the formal arguments of the method. A second problem with the OpusJava library is that both the return type and the arguments list are instances of Object, which disables sending arguments of a primitive type to and from remote objects. This reduces the interoperability of OpusJava applications with other RMI-based applications, which generally allow parameters of primitive types.. Filterfresh [2] is a Java package for building replicated, fault-tolerant servers based on an extension of the RMI registry. Similar to our approach, Filterfresh clients rely on specialized stubs that support reliable unicast. This behaviour, however, is hardcoded inside the stub, thus disabling complex interactions with the middleware (OO2). Our approach solves this problem by removing the hardwired communication strategy from the stub. Instead, communication qualifiers are introduced to specify which invocation semantics must be used when calling a remote service.. Jini [8] is a Java framework with support for late binding and dynamic service discovery. Similar to our concept of constrained service pools, developers express constraints by programming templates. Such a template is sent to a discovery service and only services matching the constraints of this template are returned. This mechanism is weaker than our where clause because it only supports exact matches on predefined query instances. Another drawback of Jini is that developers must write a considerable amount of boilerplate code for service lookup and service selection (OO1) whereas our approach provides high-level abstractions for interacting with the middleware.. JavaSymphony [6] is a Java library that allows developers to control parallelism and object locality at a higher level than basic RMI systems. Using JavaSymphony, remote objects can be grouped into hierarchical domains, sites and clusters. One advantage of JavaSymphony is that it provides basic functionality for expressing constraints on a group of remote servers. This allows developers to declaratively specify where remote objects must be instantiated. Compared to our declarative where clause, this query mechanism is rather weak, however, because it supports only conjunctive queries on predefined constants such as the DNS name or the CPU load of a server. Another problem is that these queries are not type-safe (OO3) because the relational operators (<=,<,. . . ) are represented as String instances.. Java Language Extensions. MChaRM [5] is a Java language extension based on reflective middleware. It reifies communication channels and allows developers to finetune these channels similar to our language constructs. One problem with mChaRM is that it cannot provide static type checks on the communication semantics, due to its reliance on reflection (OO3). JR [9] is another Java extension for distributed programming, but it relies on hardwired references to physical service locations, thus limiting flexibility and reuse (OO2).. Design Patterns. Approaches based on design patterns typically reify a part of the distributed architecture, such as servers, ports, and communication channels. Gomaa et al. propose interconnection patterns [7] for programming client-server interactions. Using this approach, clients and servers communicate through connectors that hide the underlying communication infrastructure. Similar patterns for multicast and reliable unicast semantics are proposed by JavaGroups [4] and by the Object Group design pattern [12] . Both works are based on reified collections of replicated services. Compared to our hierarchy of communication qualifiers, which is defined in order to hide such collections, approaches based on design patterns provide a poor level of abstraction (OO1). Moreover, they force developers to instantiate a large number of pattern-related classes for dealing with technical middleware issues, thus obfuscating the business logic.. Our type system extension based on communication qualifiers ressembles other type system extensions, such as [13] , which introduces type qualifiers for creating transparent proxies for asynchronous method calls in Java, and Javari [14] , which introduces type qualifiers for manipulating the accessibility of Java variables.

O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


A

closer

look

at

recognition-based

graphical

passwords

on

mobile

devices

Graphical

password

systems

based

on

the

recognition

of

photographs

are

candidates

to

alleviate

current

over-reliance

on

alphanumeric

passwords

and

PINs.

However,

despite

being

based

on

a

simple

concept

-and

user

evaluations

consistently

reporting

impressive

memory

retention

-only

one

commercial

example

exists

and

overall

take-up

is

low.

Barriers

to

uptake

include

a

perceived

vulnerability

to

observation

attacks;

issues

regarding

deployability;

and

the

impact

of

innocuous

design

decisions

on

security

not

being

formalized.

Our

contribution

is

to

dissect

each

of

these

issues

in

the

context

of

mobile

devices

-a

particularly

suitable

application

domain

due

to

their

increasing

significance,

and

high

potential

to

attract

unauthorized

access.

This

produces:

A

novel

yet

simple

solution

to

the

intersection

attack

that

permits

greater

variability

in

login

challenges;

Detailed

analysis

of

the

shoulder

surfing

threat

that

considers

both

simulated

and

human

testing;

A

first

look

at

image

processing

techniques

to

contribute

towards

automated

photograph

filtering.

We

operationalize

our

observations

and

gather

data

in

a

field

context

where

decentralized

mechanisms

of

varying

entropy

were

installed

on

the

personal

devices

of

participants.

Across

two

working

weeks

success

rates

collected

from

users

of

a

high

entropy

version

were

similar

to

those

of

a

low

entropy

version

at

and

login

durations

decreased

significantly

across

the

study.

User

authentication

on

mobile

devices

is

an

area

of

increasing

significance

as

their

technical

specifications

improve,

with

modern

devices

being

comparable

to

PCs

of

the

recent

past.

This

along

with

the

emergence

of

fast

data

connections

and

wireless

connectivity

has

contributed

to

devices

becoming

as

important

in

everyday

life

as

personal

computers,

in

terms

of

the

services

they

provide

and

the

data

they

store.

Consequently

mobile

devices

are

now

used

for

security

sensitive

tasks

such

as

authenticating

to

on-line

services,

authorizing

commercial

transactions,

and

accessing

corporate

e-mail..

In

these

cases

where

the

authenticity

of

users

is

of

high

importance

the

device

itself

should

implement

an

authentication

mechanism

to

defend

against

opportunistic

access

by

attackers

to

data

and

services.

Official

UK

Home

Office

statistics

report

that

devices

were

stolen

throughout

the

UK

in

with

unofficial

estimates

as

high

as

Moreover,

statistics

from

report

that

of

mobile

device

thefts

occurred

when

the

device

was

left

unattended

In

the

face

of

such

figures,

users

attributing

privacy

solely

to

their

assumed

physical

possession

of

the

device

are

taking

a

risk;

as

the

possessor

of

an

unprotected

device

assumes

the

full

capabilities

offered

by

the

on-board

credentials.

This

access

can

even

occur

with

the

consent

of

the

user,

as

it

is

common

for

users

to

briefly

share

mobile

devices

-particularly

with

friends

and

family

-for

making

or

receiving

calls

Currently

mobile

devices

support

a

binary

security

model

where

the

user

is

either

legitimate

or

not.

PINs

are

the

de

facto

authentication

mechanism

used

in

this

model

due

to

their

ease

of

implementation,

cost

and

accessibility

to

multiple

platforms.

However

it

is

very

common

for

users

to

forget

a

sequence

of

numbers,

even

when

used

frequently

One

survey

reports

that

only

onethird

of

mobile

device

users

actually

enforce

PIN

protection,

find

PINs

to

be

inconvenient,

but

are

in

favour

of

more

device

security.

Graphical

Passwords

on

Mobile

Devices?:

One

option

to

reinforce

device

security

is

user

authentication

based

on

graphical

passwords

These

are

knowledge-based

authentication

mechanisms

conceptually

underpinned

by

dual-coding

theory

that

postulates

that

both

visual

and

verbal

information

are

processed

differently

in

the

brain

and

both

are

complimentary

to

the

encoding

of

an

object

in

memory.

Shepard

shows

that

test

subjects

were

accurate

in

identifying

previously

seen

images

when

presented

with

pairs,

and

making

a

binary

response.

The

goal

is

to

design

knowledge-based

authentication

systems

around

this

effect

to

help

users

reliably

retain

random

authentication

secrets

of

higher

entropy

than

is

possible

with

PINs

or

alphanumeric

passwords.

Arguably

the

most

intuitive

genre

is

based

on

recognition.

In

a

typical

login

protocol

the

user

is

challenged

to

recognize

pre-assigned

key

images

among

decoy

images.

Fig.

illustrates

an

example

challenge..

Variations

of

this

approach

have

been

proposed

many

times

in

previous

research

however

despite

being

built

on

an

intuitive

concept

-and

their

usability

being

highlighted

in

each

user

study

-only

one

commercial

example

exists

and

other

developments

are

non-existent.

We

believe

this

lack

of

usage

can

be

attributed

to

perceived

shortcomings

in

security

and

deployability.

Security

concerns

include

a

perceived

vulnerability

to

shoulder

surfing,

where

an

attacker

uses

simple

observation

techniques

to

learn

authentication

credentials

and

later

use

them

in

a

replay

attack;

and

intersection

attack

where

the

frequency

of

images

appearing

at

login

can

be

used

to

determine

their

importance..

A

more

pragmatic

limitation

exists

in

terms

of

deployability.

For

example,

to

bootstrap

systems

with

images;

administrators

must

source

images

to

use

and

filter

them

to

reduce

the

potential

for

logins

comprising

confusing

visual

searches

that

cause

false-negative

login

results.

Many

previous

works

place

this

problem

out

of

scope..

Recognition-based

systems

have

the

potential

to

form

deployable,

decentralized,

solutions

of

varying

entropy

on

mobile

devices

for

a

number

of

reasons:

They

require

only

simple

interaction

that

is

suited

to

keypads

or

touchscreens;

Device

screen

resolutions

are

improving

quickly

(Nokia

has

a

display);

The

perceived

vulnerability

to

observation

is

intuitively

offset

by

small

screen

sizes;

Devices

are

often

camera-enabled

which

means

many

users

already

have

photographs

on

devices

that

can

be

used

for

initialization.

Contributions:

Motivated

by

the

above,

our

contribution

is

to

investigate

pending

pertinent

aspects

of

security,

deployability

and

usability:.

Shoulder

Surfing

Analysis

We

analyze

the

key

image

portfolio

concept

proposed

to

complicate

observation

attacks,

and

secure

its

inherent

vulnerability

to

intersection

attack.

We

also

quantify

the

benefit

of

this

approach

by

developing

a

computer

simulation

of

an

attack

assuming

short

term

memory

and

camera

attacks

are

the

adversary.

We

also

carry

out

a

user

study

to

explore

how

real

users

compare..

Novel

solution

to

intersection

attack

A

widely-accepted

solution

to

an

intersection

attack

is

to

keep

each

login

challenge

the

same.

We

present

a

new

simple

method

that

combines

the

key

image

portfolio

with

a

decoy

image

portfolio

that

innately

permits

greater

visual

variation

in

login

challenges..

Decentralized

infrastructure

using

only

personal

images

Users

have

increased

memorability

for

personal

images

and

assuming

the

presence

of

these

on

the

device

of

the

user

(or

on

other

importable

mediums),

these

can

be

used

to

initialize

systems

and

is

immune

to

image

source-based

attacks

such

as

social

engineering

Automated

image

filtering

techniques

In

the

case

where

users

initialize

a

system

using

their

own

images,

there

must

exist

an

initial,

automated

phase

of

filtering

to

remove

those

that

could

contribute

to

false-negative

login

results.

We

make

a

first

exploration

of

image

processing

techniques

to

automatically

filter

visually

similar

and

unmemorable

photographs..

Based

on

our

observations

we

gather

field

data

from

two

exemplar

systems

of

varying

entropy.

We

discovered

that

average

successful

login

durations

recorded

from

both

systems

significantly

decreased

after

one

week

of

usage,

and

overall

success

rates

were

similar

across

both

systems

at

although

in

one

week

of

reduced

usage,

users

of

a

low

entropy

system

were

significantly

more

successful

than

those

using

a

high

entropy

version..

The

rest

of

the

paper

is

organized

as

follows:

Section

reviews

related

work,

Section

considers

the

various

traditional

threats

associated

with

systems

of

this

genre

and

our

own

analysis

and

solutions.

Section

considers

how

manipulations

of

the

images

themselves

can

have

both

security

and

usability

implications.

This

leads

us

to

introduce

two

implementations

in

Section

and

their

evaluation

in

user

studies

from

Section

Finally

we

discuss

our

findings

from

Section

and

conclude

in

Section

We

have

gathered

results

that

give

a

first

suggestion

of

realworld

performance

levels

to

be

expected

from

two

recognitionbased

graphical

password

systems

(of

varying

entropy)

on

mobile

devices.

Users

were

assigned

key

images

and

despite

having

relatively

little

training,

performance

was

good

irrespective

of

the

mechanism

as

success

rates

were

for

each

system.

Users

of

the

high

entropy

version

experienced

two

lockouts,

where

access

was

"'blocked"'

after

incorrect

attempts.

Of

course,

in

a

study

context

outside

of

the

lab

this

could

be

attributed

to

any

number

of

reasons.

The

success

rates

reported

are

similar

to

those

reported

in

a

field

study

of

Passpoints

where

success

rates

ranged

from

Other

field

studies

that

provide

means

of

comparison

include

Passfaces

and

Dynahand

While

this

may

seem

like

a

large

difference,

the

low

entropy

system

exhibited

higher

entropy

than

each

of

the

aforementioned

systems

(excluding

Passpoints),

and

it

is

likely

that

a

longer

study

would

have

allowed

any

performance

extremes

to

stabilize..

In

a

test

that

explored

the

shoulder

surfing

capabilities

of

user

study

participants

we

intuitively

discovered

that

users

of

the

high

entropy

system

-where

images

were

smaller

and

of

reduced

quality

-needed

on

average

observations

to

obtain

a

successful

login

compared

to

logins

where

participants

attacked

the

low

entropy

system

-where

images

were

displayed

larger

and

in

higher

quality.

An

attack

on

a

PIN

is

likely

to

only

need

observations,

meaning

visual

authentication

solutions

using

photographs

are

likely

to

provide

more

resistance

in

practice

to

shoulder

surfing.

One

contributing

reason

is

that

all

users

of

PINs

are

familiar

with

the

alphabet

from

which

PINs

are

drawn,

which

is

not

the

case

where

login

challenges

are

constructed

with

the

personal

images

of

the

user..

Despite

the

increasing

presence

of

biometrics

for

user

authentication

on

consumer

electronics

e.g.

laptops,

knowledge-based

authentication

systems

are

likely

to

remain

attractive

due

to

being

purely

software-based

solutions.

Graphical

password

systems

based

on

recognition

potentially

have

a

role

to

play

in

this

area,

due

to

accurate

user

performance

in

previous

studies,

including

this

one.

One

key

limitation

however,

is

that

login

durations

recorded

for

our

systems

-and

others

-are

still

too

long.

User

acceptance

is

often

driven

by

convenience

and

login

durations

of

approximately

seconds

are

unattractive

to

many

users..

In

this

work

we

have

concentrated

particularly

on

mobile

devices,

however

deployment

of

recognition-based

mechanisms

on

the

Internet

presents

different

challenges

Another

goal

of

these

systems

should

be

to

contribute

to

the

alleviation

of

the

password

management

problem

currently

experienced

on

the

Internet.

In

order

to

make

this

a

feasible

goal,

we

feel

image

processing

has

an

important

role

to

play

to

improve

the

scalability

of

these

systems.

The

image

filtering

mechanisms

deployed

in

this

work

were

not

sufficient

to

entirely

solve

the

filtering

problem,

particularly

in

determining

image

similarity

due

to

its

subjective

nature.

Future

contributions

will

be

the

further

exploration

of

image

analysis

to

provide

automated

and

intelligent

selection

of

images

for

particular

graphical

password

systems.

The

average

number

of

observations

required

for

imposters

to

login

was

(σ

against

the

high

entropy

system

compared

to

(σ

against

the

low

entropy

version.

A

Mann-Whitney

test

shows

this

to

be

a

significant

difference

(U

p

Referring

back

to

the

simulations

presented

in

fig.

high

entropy

participants

performed

as

well

as

attackers

with

memory

accuracy

(not

detailed

on

the

graph),

whilst

low

entropy

participants

were

accurate.

This

difference

is

reasonable

since

the

shoulder

surfing

task

for

high

entropy

participants

was

more

difficult,

more

images

were

displayed

and

of

a

lower

quality.

There

were

instances

where

participants

were

unable

to

login

as

an

imposter,

using

high

entropy

and

using

low

entropy.

The

mean

login

durations

of

legitimate

users

was

seconds

(σ

and

seconds

Figure

The

context

of

the

replay

attack

study,

participants

could

sit

or

stand.

This

would

give

an

impression

of

how

human

memory

compared

to

our

shoulder

surfing

simulations..

(σ

for

an

imposter

(U

p

We

calculated

this

using

knowledge

of

the

time

and

date

of

this

study

in

the

system

log.

Fig.

illustrates

the

difference

in

the

distribution

of

performance

between

legitimate

users

and

imposters.

During

the

study

we

did

observe

that

the

key

image

portfolio

did

provide

some

temporary

resistance

to

an

impostor

login.

In

the

context

of

a

lunchtime

attack

this

temporary

delay

could

resist

attack

for

a

significant

period

of

time

depending

on

the

access

gained

to

the

device

by

an

attacker.

There

are

typically

three

genres

of

graphical

password

system:

recall

based,

cued-recall

based

and

recognition-based.

Draw

a

Secret

(DAS)

is

the

most

prominent

recall

based

system

and

involves

creating

a

freehand

drawing

and

remembering

its

composition

aided

by

a

drawing

grid.

This

can

achieve

significantly

higher

levels

of

entropy

than

recognition

and

cued-recall

based

systems

with

a

comparable

cognitive

load.

Passpoints

is

the

main

exemplar

of

the

cued-recall

genre

where

the

user

must

remember

a

sequence

of

clicks

positions

in

an

image.

Image

processing

techniques

and

less

sophisticated

attacks

have

been

applied

to

render

this

system

effectively

broken.

Table

collates

recognition-based

systems

featuring

in

previous

research

and

highlights

key

characteristics.

Passfaces

is

the

main

exemplar

and

has

the

only

commercial

presence.

In

field

studies

this

has

been

shown

to

exhibit

increased

login

success

rates

over

alphanumeric

passwords

Also,

one

study

explored

how

the

stimuli

of

faces

might

affect

the

ubiquitous

practices

of

writing

down

and

sharing

passwords

Dhamija

and

Perrig

evaluated

a

system

based

on

recognition

of

fractals

and

first

considered

the

intersection

attack.

De

Angeli

et

al.

evaluated

different

forms

of

a

system

called

VIP,

and

reported

that

static

positioning

of

images

between

login

challenges

aided

memorability.

They

also

report

that

while

there

does

exist

a

picture

superiority

effect

that

can

be

exploited

in

authentication,

the

benefit

of

this

can

be

lost

if

a

scheme

is

not

designed

to

harness

this

effect.

In

general,

this

genre

is

suitable

to

achieving

entropy

comparable

to

a

randomly

generated

PIN

bits)

due

to

its

inherent

poor

scalability.

Entropy

is

increased

by

requiring

users

to

remember

more

key

images,

and

be

challenged

with

more

decoy

images,

which

can

make

the

visual

search

tiresome..

In

order

to

reduce

the

threat

of

shoulder

surfing

more

complicated

entry

is

often

required.

Weinshall

presents

a

method

where

users

do

not

explicitly

select

key

images,

but

use

them

to

algorithmically

obtain

a

result

that

if

observed

is

not

useful

in

a

replay

attack.

However

using

knowledge

of

the

algorithm

used

for

entry,

Golle

and

Wagner

were

able

to

derive

key

images

using

a

SAT

solver.

fractals

fractals

yes

manual

Passfaces

stock

stock

no

manual

Awase

and

Use

your

Illusion

(UYI)

are

both

designed

for

mobile

devices.

In

Awase

users

upload

personal

images

to

a

server

to

comprise

key

images,

while

decoys

are

drawn

from

the

images

of

other

participating

users,

a

configuration

shared

with

Pering

et

al.

User

recall

was

over

as

long

as

weeks

however

their

measures

to

protect

against

intersection

attack

are

unclear.

UYI

considered

the

difficulty

of

displaying

images

for

authentication

on

low

resolution

devices

by

blurring

images

in

a

controlled

way.

They

reported

recall

over

weeks,

except

in

the

condition

where

users

were

assigned

key

images

when

this

reduced

to

Pering

et

al.

evaluated

a

novel

system

for

public

terminals,

where

users

would

recognize

a

sequence

of

one-time

images

from

their

personal

collection.

They

also

explored

vulnerability

to

social

engineering

attacks

where

attackers

were

given

a

subset

of

a

user

images

and

asked

to

use

the

information

gained

(e.g.

recurrence

of

individuals

or

themes)

to

guess

the

key

images.

In

the

worst

case

attackers

were

successful.

Dynahand

is

a

system

where

users

are

asked

to

recognize

their

own

handwriting.

This

work

also

considered

the

problem

that

some

people

have

similar

handwriting

and

considered

automated

methods

of

filtering

using

statistical

moments

and

vector

quantisation..

These

schemes

can

be

further

organised

between

two

categories,

one-key-per-screen

and

multiple

selection

In

the

first

instance

key

images

are

evenly

distributed

across

login

screens

so

that

on

each

screen

displayed

to

the

user,

one

key

image

exists

amongst

decoys.

In

the

latter,

zero,

one,

or

more

than

one

key

image

can

appear

per

screen;

this

is

desirable

as

entropy

can

be

adjusted

without

increasing

the

number

of

grids

presented.

Another

approach

altogether

is

to

use

image

passwords

as

a

memory

aid

for

recall

of

PINs

as

seen

with

FacePIN

This

requires

no

changes

to

infrastructure

and

in

a

small

study

showed

promise.

We

developed

two

implementations

to

operationalize

our

observations

and

analysis,

one

of

high

entropy

and

one

of

low

entropy.

This

was

to

reflect

the

fact

that

recognition-based

mechanismswithin

certain

bounds

of

complexity

-are

flexible

as

to

the

entropy

they

can

usably

provide.

Both

embody

the

interventions

discussed

previously,

and

have

the

capability

to

be

bootstrapped

using

images

taken

directly

using

the

camera

functionality

of

device.

A

high

level

overview

of

the

user

experience

is

as

follows:

firstly

the

user

provides

images

to

a

client

application

that

resizes

the

images

and

initiates

the

image

filtering

process.

The

resulting

set

of

images

is

then

transferred

to

the

device,

from

which

subsets

are

then

randomly

selected

to

populate

the

key

image

portfolio

and

the

decoy

image

portfolio.

For

the

two

implementations,

we

decided

to

ask

the

user

to

identify

random

key

images

from

the

key

portfolio

of

amongst

a

random

subset

of

decoys

from

the

decoy

portfolio.

This

number

was

informed

by

intuitive

usability

concerns

raised

by

asking

the

user

to

retain

more

than

this

number.

The

selected

images

from

each

portfolio

were

then

shuffled

together

to

comprise

the

login

challenge.

We

recruited

participants

within

the

organization

through

the

use

of

internal

mailing

lists,

with

the

incentive

of

free

cinema

tickets.

Although

this

was

reduced

to

in

the

early

phases

of

the

study

as

the

device

of

one

participant

failed

and

participation

could

not

continue.

We

chose

a

between-subjects

design

and

split

participants

randomly

between

the

two

systems,

this

meant

using

the

low

entropy

system

and

using

the

high

entropy

version.

All

participants

were

smartphone

users

for

regularly

accessing

work

email

and

other

web-based

services,

which

we

believe

placed

them

within

a

key

target

group

given

our

perceptions

of

who

might

need

enhanced

user

authentication..

To

initiate

the

experiment,

participants

visited

the

research

lab

with

a

portfolio

of

approximately

images

either

already

on

their

personal

device

or

on

removable

storage.

We

chose

to

ask

for

as

in

our

informal

tests

the

filtering

software

removed

approximately

images

from

a

typical

collection.

This

filtering

took

the

form

of

the

execution

of

software

involving

a

combination

of

our

slightly

modified

PerceptualDiff

canny

edge

detection,

and

manual

intervention

as

a

last

resort

(in

depth

analysis

of

our

filtering

mechanisms

is

ongoing

work,

shows

its

efficacy).

The

assigned

mechanism

was

installed

on

the

personal

device

of

each

participant,

and

the

resized,

filtered

images

imported

automatically.

For

the

enrollment

period

participants

were

automatically

assigned

key

images

and

asked

to

achieve

consecutive

correct

logins

in

the

presence

of

the

moderator.

The

mechanism

was

not

actively

securing

the

device,

but

was

an

application

that

allowed

the

user

to

test

retention

of

key

images

throughout

the

study.

Performance

data

such

as

success/failure

of

the

login,

time/date

of

the

login

and

login

duration

were

logged

automatically,

and

upon

entry

of

a

secret

key

combination

could

be

output

to

a

file..

Our

study

design

was

similar

to

that

of

Everitt

et

al.

where

participants

were

sent

emails

when

it

was

desired

they

should

perform

a

login.

For

our

purposes,

this

configuration

had

the

potential

to

be

more

effective

since

all

participants

read

emails

on

their

device,

the

same

location

on

which

the

mechanism

would

be

installed.

This

gave

us

the

opportunity

to

control

the

frequency

of

logins

to

the

system.

For

the

first

week

participants

would

be

asked

to

login

twice

per

working

day,

for

the

second

week

participants

were

asked

to

login

twice

per

day,

every

two

days.

We

hoped

to

gauge

the

effect

of

reduced

usage

on

success

rates

after

an

intensive

first

week

of

usage.

On

days

where

a

login

was

required,

we

sent

participants

an

email

at

and

to

request

that

they

perform

a

login.

Upon

receiving

the

email

the

participant

would

be

required

to

open

the

application

and

attempt

to

login.

Upon

success,

the

program

disappeared

into

the

background,

but

if

a

participant

could

not

login

after

three

attempts

they

would

be

locked

out,

and

offered

a

logged

reminder

so

they

could

continue

with

the

study.

At

the

end

of

the

study,

the

participants

visited

the

lab

so

that

the

log

file

of

performance

data

could

be

extracted.

An

example

entry

from

an

extracted

log

file

(with

added

formatting)

is

the

following:

*******************Login************************

******************End

Login********************

From

these

entries

we

were

able

to

analyse

statistics

of

user

performance.

The

sequence

of

numbers

refers

uniquely

to

each

image

used

in

the

system.

O O O O O B I O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O B I O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O


Privacy in Non-private Environments We study private computations in information-theoretical settings on networks that are not 2-connected. Non-2-connected networks are "non-private" in the sense that most functions cannot privately be computed on them. We relax the notion of privacy by introducing lossy private protocols, which generalize private protocols. We measure the information each player gains during the computation. Good protocols should minimize the amount of information they lose to the players. Throughout this work, privacy always means 1-privacy, i.e. players are not allowed to share their knowledge. Furthermore, the players are honest but curious, thus they never deviate from the given protocol.The randomness used by the protocol yields distributions on communication strings for each player and for each input. We define the loss of a protocol to a player as the logarithm of the number of different probability distributions the player can observe. This is justified since we prove that in optimal protocols, the distributions have pairwise disjoint support. Thus, the players can easily distinguish them, and the logarithm of their number is the number of bits the player learns.The simplest non-2-connected networks consists of two blocks that share one bridge node. We prove that on such networks, communication complexity and the loss of a private protocol are closely related: Up to constant factors, they are the same.Then we study one-phase protocols, an analogue of one-round communication protocols. In such a protocol each bridge node may communicate with each block only once. We investigate in which order a bridge node should communicate with the blocks to minimize the loss of information. In particular, for symmetric functions it is optimal to sort the components by increasing size. Then we design a one-phase protocol that for symmetric functions simultaneously minimizes the loss at all nodes where the minimum is taken over all one-phase protocols.Finally, we prove a phase hierarchy. For any k there is a function such that every (k − 1)-phase protocol for this function has an information loss that is exponentially greater than that of the best k-phase protocol. Consider a set of players, each knowing an individual secret. They want to compute some function depending on their secrets. But after the computation, no player should know anything about the secrets of the other players except for what he is able to deduce from his own secret and the function value. This is the aim of private computation (also called secure multi-party computation). To compute the function, the players can send messages to each other using secure links.. An example for such a computation is the "secret voting problem": The members of a committee wish to decide whether the majority votes for yes or no. But after the vote nobody should know anything about the opinions of the other members, not even about the exact number of yes and no votes, except for whether the majority voted for yes or no.. If no group of at most t players can infer anything about the input bits that cannot be inferred from the function value and their own input bits, we speak of t-privacy.. Any Boolean function can privately (in the following we identify privately with 1-privately) be computed on any 2-connected network. Unfortunately, there are many Boolean functions, even simple ones like parity, disjunction, or conjunction, that cannot privately be computed if the underlying network is not 2-connected [6] .. However, many real-world networks are not 2-connected and private computation is not possible. If the players in the network have to compute something but do not trust each other, there is a natural interest of the players in privacy. What can we do? We relax the notion of privacy: One cannot require that any player learns only what he is able to deduce from his own secret and the function value. Instead we require that any player learns as little as possible about the secrets of the other players (in an information-theoretical sense) while it is still possible to compute the function.. Bridge nodes are important when considering non-2-connected networks. For all non-bridge players we can guarantee that they do not learn anything except for what they can deduce from their own bit and the function value. Thus, the bridge players are the only players that are able to learn something more. The question is how much the bridge players need to learn such that the function can be computed. The simplest setting is a network of two blocks with one bridge node in common. (A block is a maximal 2-connected subnetwork.) This reminds one of communication complexity with a man in the middle: Alice (one block) and Bob (another block) want to compute a function depending on their input while preventing Eve (the bridge node) from learning anything about their input. Unfortunately, Eve listens to the only communication channel between Alice and Bob. In terms of communication complexity, this problem has been examined by Modiano and Ephremedis [14, 15] and Orlitsky and El Gamal [17] under cryptographic security. In contrast, we deal with informationtheoretical security, i.e. the computational power of the players is unrestricted. Furthermore, we are not interested in minimizing communication but in minimizing the information learned by any player. It turns out that there is a close relation between communication and privacy, at least in this special case.

O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B I I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O