On Overcoming the Identified Limitations of a Usable PIN Entry Method
In the domain of password security, research has made significant progress in handling different kinds of threats which require human intelligence factor to fix the vulnerabilities. In spite of having strong theoretical establishments, most of these defense mechanisms cannot be used in practice as h...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2019-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8817967/ |
| _version_ | 1818416078688092160 |
|---|---|
| author | Nilesh Chakraborty Jianqiang Li Samrat Mondal Fei Chen Yi Pan |
| author_facet | Nilesh Chakraborty Jianqiang Li Samrat Mondal Fei Chen Yi Pan |
| author_sort | Nilesh Chakraborty |
| collection | DOAJ |
| description | In the domain of password security, research has made significant progress in handling different kinds of threats which require human intelligence factor to fix the vulnerabilities. In spite of having strong theoretical establishments, most of these defense mechanisms cannot be used in practice as humans have limitations in processing complex information. The little bit of good news is that very few research proposals in this field have shown the promises to be deployable in practice. This paper focuses on such one method - proposed by Roth et al. back in 2004, which provides adequate user-friendliness to enter Personal Identification Number (PIN) securely in the presence of human shoulder surfers. Surprisingly, the background algorithm of this method for validating users' responses runs in linear time on a search space of cardinality 5 and hence, the validation process does not put much load on the authenticating device. Therefore, such human identification protocol can also be integrated into the IoT infrastructure for conducting a more secured login from the client-side. Having such advantages, though remained secure for almost ten years after its release in 2004, recently, few proposals revealed some serious vulnerable aspects of the Roth et al.'s proposal. In this paper, we have taken an attempt to save this user-friendly form of authentication. Firstly, we have made a critical discussion on the importance of the targeted PIN entry method in the domain of usable security and then given a brief overview of the identified limitations of this protocol. Followed by this, a few initiatives have been taken to fix the identified vulnerabilities of Roth et al.'s proposal by revising its working principle, while the login procedure and the usability standard of this method stay unaffected. |
| first_indexed | 2024-12-14T11:45:10Z |
| format | Article |
| id | doaj.art-6fd170bb68af427995da31f6e3abb129 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-14T11:45:10Z |
| publishDate | 2019-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-6fd170bb68af427995da31f6e3abb1292022-12-21T23:02:38ZengIEEEIEEE Access2169-35362019-01-01712436612437810.1109/ACCESS.2019.29379488817967On Overcoming the Identified Limitations of a Usable PIN Entry MethodNilesh Chakraborty0https://orcid.org/0000-0002-3825-8838Jianqiang Li1Samrat Mondal2Fei Chen3https://orcid.org/0000-0001-8132-539XYi Pan4College of Computer Science and Software Engineering, Shenzhen University, Shenzhen, ChinaCollege of Computer Science and Software Engineering, Shenzhen University, Shenzhen, ChinaDepartment of Computer Science and Engineering, IIT Patna, Patna, IndiaCollege of Computer Science and Software Engineering, Shenzhen University, Shenzhen, ChinaDepartment of Computer Science, Georgia State University, Atlanta, GA, USAIn the domain of password security, research has made significant progress in handling different kinds of threats which require human intelligence factor to fix the vulnerabilities. In spite of having strong theoretical establishments, most of these defense mechanisms cannot be used in practice as humans have limitations in processing complex information. The little bit of good news is that very few research proposals in this field have shown the promises to be deployable in practice. This paper focuses on such one method - proposed by Roth et al. back in 2004, which provides adequate user-friendliness to enter Personal Identification Number (PIN) securely in the presence of human shoulder surfers. Surprisingly, the background algorithm of this method for validating users' responses runs in linear time on a search space of cardinality 5 and hence, the validation process does not put much load on the authenticating device. Therefore, such human identification protocol can also be integrated into the IoT infrastructure for conducting a more secured login from the client-side. Having such advantages, though remained secure for almost ten years after its release in 2004, recently, few proposals revealed some serious vulnerable aspects of the Roth et al.'s proposal. In this paper, we have taken an attempt to save this user-friendly form of authentication. Firstly, we have made a critical discussion on the importance of the targeted PIN entry method in the domain of usable security and then given a brief overview of the identified limitations of this protocol. Followed by this, a few initiatives have been taken to fix the identified vulnerabilities of Roth et al.'s proposal by revising its working principle, while the login procedure and the usability standard of this method stay unaffected.https://ieeexplore.ieee.org/document/8817967/AuthenticationPINobservation-attackkey-logger-attackdefensehuman-intelligence-factor |
| spellingShingle | Nilesh Chakraborty Jianqiang Li Samrat Mondal Fei Chen Yi Pan On Overcoming the Identified Limitations of a Usable PIN Entry Method IEEE Access Authentication PIN observation-attack key-logger-attack defense human-intelligence-factor |
| title | On Overcoming the Identified Limitations of a Usable PIN Entry Method |
| title_full | On Overcoming the Identified Limitations of a Usable PIN Entry Method |
| title_fullStr | On Overcoming the Identified Limitations of a Usable PIN Entry Method |
| title_full_unstemmed | On Overcoming the Identified Limitations of a Usable PIN Entry Method |
| title_short | On Overcoming the Identified Limitations of a Usable PIN Entry Method |
| title_sort | on overcoming the identified limitations of a usable pin entry method |
| topic | Authentication PIN observation-attack key-logger-attack defense human-intelligence-factor |
| url | https://ieeexplore.ieee.org/document/8817967/ |
| work_keys_str_mv | AT nileshchakraborty onovercomingtheidentifiedlimitationsofausablepinentrymethod AT jianqiangli onovercomingtheidentifiedlimitationsofausablepinentrymethod AT samratmondal onovercomingtheidentifiedlimitationsofausablepinentrymethod AT feichen onovercomingtheidentifiedlimitationsofausablepinentrymethod AT yipan onovercomingtheidentifiedlimitationsofausablepinentrymethod |