A graphical-based password keystroke dynamic authentication system for touch screen handheld mobile devices

Abstract

Since touch screen handheld mobile devices have become widely used, people are able to access various data and information anywhere and anytime. Most user authentication methods for these mobile devices use PIN-based (Personal Identification Number) authentication, since they do not employ a standard QWERTY keyboard for conveniently entering text-based passwords. However, PINs provide a small password space size, which is vulnerable to attacks. Many studies have employed the KDA (Keystroke Dynamic-based Authentication) system, which is based on keystroke time features to enhance the security of PIN-based authentication. Unfortunately, unlike the text-based password KDA systems in QWERTY keyboards, different keypad sizes or layouts of mobile devices affect the PIN-based KDA system utility. This paper proposes a new graphical-based password KDA system for touch screen handheld mobile devices. The graphical password enlarges the password space size and promotes the KDA utility in touch screen handheld mobile devices. In addition, this paper explores a pressure feature, which is easy to use in touch screen handheld mobile devices, and applies it in the proposed system. The experiment results show: (1) EER is 12.2% in the graphical-based password KDA proposed system. Compared with related schemes in mobile devices, this effectively promotes KDA system utility; (2) EER is reduced to 6.9% when the pressure feature is used in the proposed system. The accuracy of authenticating keystroke time and pressure features is not affected by inconsistent keypads since the graphical passwords are entered via an identical size (50 mm × 60 mm) human–computer interface for satisfying the lowest touch screen size and a GUI of this size is displayed on all mobile devices.

Introduction

Whenever people use services such as e-bank and e-mail, servers should have the ability to authenticate the users’ identities. Otherwise, anyone can easily impersonate a legal user to login to the server. Password-based authentication schemes are simple and practical solutions to user identification because they allow people to choose their own passwords without any device to generate or store them. For personal computers, passwords consist of letters, numbers, and special punctuations on a standard QWERTY keyboard. This is called text-based (alphanumeric-based) password authentication. Handheld mobile devices do not have standard QWERTY keyboard to conveniently enter text-based passwords. Mobile devices often use numeric passwords, which is called PIN-based (Personal Identification Number) authentication. Though the password space size of text-based passwords is larger than that of PINs (i.e., the password space size of an 8-character text-based password and an 8-digital PIN are 64⁸ ≅ 2.8 × 10¹⁴ and 10⁸, respectively), text-based passwords are preferred natural language phrases that people can recognize easily and are therefore susceptible to dictionary attacks. On the other hand, PIN-based authentication is widely used in mobile devices, but it provides a small password space size and therefore compromises security.

The KDA (Keystroke Dynamic-based Authentication) system was first proposed by Gaines et al. (1980). It is a biometric measurement method to provide additional security for text-based passwords. Many studies (Araújo et al., 2005, Bergadano et al., 2002, Bleha et al., 1990, Boechat et al., 2007, Chang and Yang, in press, Haider et al., 2000, Harun et al., 2010, Hwang et al., 2009b, Killourhy and Maxion, 2009, Ru and Eloff, 1997, Shih and Lin, 2008, Xi et al., 2011) have been proposed to improve the text-based password KDA system utility. KDA systems confirm the correctness of passwords and also identify users based on individual password keystroke time features. The keystroke time features include the duration of a keystroke (keystroke hold time) and the interval of the keystrokes (keystroke latency time). Even if the password is revealed by dictionary attacks or shoulder surfing attacks, the probability of breaking authentication is reduced. The KDA system has the following advantages. It is low-cost with no extra device to obtain the user's features, and does not require complex computations to capture the user's features. Since the process of capturing features is done when the user enters his or her password, it does not create any additional burden on users. Compared with other biometric authentication methods such as fingerprints, eye scan, iris, and signature, the KDA system is simple and useful for providing additional security in identity verification.

As is well known, mobile devices are widely used for accessing various data and information. Campisi et al. (2009) proposed a text-password KDA system that uses a cellular phone keypad. On the other hand, many studies (Clarke and Furnell, 2007a, Clarke and Furnell, 2007b, Hwang et al., 2009a) have applied KDA systems to enhance the security of PIN-based authentication in mobile devices. However, the sizes or layouts of keypads of the mobile devices produced by different manufacturers are inconsistent. A user may not get used to entering his or her PIN or text-based password through different mobile devices. This will result in the user's features being entered inconsistently and KDA system verification failing if users enter their PINs or text-based passwords through difference mobile devices. Consequently, the KDA system utility for mobile devices (Campisi et al., 2009, Clarke and Furnell, 2007a, Clarke and Furnell, 2007b, Hwang et al., 2009a) is worse than that for QWERTY keyboards (Killourhy and Maxion, 2009, Shih and Lin, 2008).

This paper develops a novel graphical-based password KDA system to improve PIN-based authentication for mobile devices. The password space size of the proposed system is larger than those of PIN-based authentication schemes. Regardless of the size of the user's mobile touch screen, users enter their graphical passwords through clicking or touching an identical human–computer interface. Therefore, the accuracy of users authentication is not affected by inconsistent keypads. In addition, this paper explores the pressure feature, which is a new biometric keystroke feature found in touch screens. The proposed graphical-based password KDA system is implemented in an Android-compatible phone. Serial experiments show the utility of the proposed graphical-based password KDA system is better than the related text-based password and PIN-based KDA systems (Campisi et al., 2009, Clarke and Furnell, 2007a, Clarke and Furnell, 2007b). Moreover, when the pressure feature is applied in the proposed system, it further promotes system utility.

The organization of this paper is as follows. Section 2 reviews and discusses studies on graphical-based password authentication and the PIN-based KDA system, respectively. Section 3 proposes the architecture of the methodology, which includes the enrollment phase, the classifier building phase, and the authentication phase. The pressure feature is also introduced in this section. Section 4 presents the experimental results of this paper and compares them with other related studies. At the same time, the performance of the proposed system is presented. It is suitable for low-power mobile devices. Finally, conclusions are given in Section 5.