• Journal of Korea Multimedia Society
• /
• v.19 no.2
• /
• pp.280-290
• /
• 2016

In this paper, we propose a layered pattern authentication scheme resistant to social engineering attacks. Existing android pattern lock scheme has some weak points for social engineering attacks. Thus, the proposed scheme improves the existing pattern lock scheme. In our scheme, pattern is recorded by touch screen, however, it is different with existing schemes because of the layered pattern. During the pattern registration process, users register their own pattern with many layers. Thus, registered pattern is 3D shape. When the smudge attack is occurring, the attacker can see the shape of user pattern through the smudge on smartphone screen. However, it is described on 2D surface, so acquired pattern is not fully determine to users original 3D shape. Therefore, our scheme is resistant to social engineering attack, especially smudge attack.

• Journal of Industrial Convergence
• /
• v.21 no.2
• /
• pp.117-123
• /
• 2023

In the fintech environment, Smart phones are mainly used for various service. User authentication technology is required to use safe services. Authentication is performed by transmitting authentication information to the server when the PIN or password is entered and touch the button completing authentication. But A post-attack is possible because the smudge which is the trace of using screen remains instead of recording attack with a camera or SSA(Shoulder Surfing Attack). To prevent smudge attacks, users must erase their fingerprints after authentication. In this study, we proposed a technique to determine whether to erase fingerprints. The proposed method performed erasing fingerprint which is the trace of touching after entering PIN and designed the security keypads that processes instead of entering completion button automatically when determined whether the fingerprint has been erased or not. This method suggests action that must erase the fingerprint when entering password. By this method, A user must erase the fingerprint to complete service request and can block smudge attack.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.4
• /
• pp.903-910
• /
• 2016

As smart mobile devices having touchscreens are growingly deployed, a pattern lock system, which is one of the graphical password systems, has become a major authentication mechanism. However, a user's unlocking behaviour leaves smudges on a touchscreen and they are vulnerable to the so-called smudge attacks. Smudges can help an adversary guess a secret pattern correctly. Several advanced pattern lock systems, such as TinyLock, have been developed to resist the smudge attacks. In this paper, we study an automated smudge attack that employs machine learning techniques and its effectiveness in comparison to the human-only smudge attacks. We also compare Android pattern lock and TinyLock schemes in terms of security. Our study shows that the automated smudge attacks are significantly advanced to the human-only attacks with regard to a success ratio, and though the TinyLock system is more secure than the Android pattern lock system.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.28 no.5
• /
• pp.1113-1118
• /
• 2018

Fingerprint authentication is the most popular biometric in smart devices. However it has vulnerability to fake fingerprints. This paper shows that it is possible to pass fingerprint authentication of smartphone by creating counterfeit fingerprint without approval of legitimate users. As a technical countermeasure to prevent such a smudge-based attack, there has been proposed an under-screen Touch ID with a slide bar, which is a method of removing the fingerprint trail by dragging the UI to the side after fingerprint authentication on the touch screen. In this paper, we analyze how the proposed attack method and mitigation are perceived by actual user through 61 user survey.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.4
• /
• pp.470-476
• /
• 2019

The pattern locking technique applied to smart phones is a locking technique that many people use conveniently. However, the safety of pattern locking techniques is very low compared with other techniques. The pattern locking technique is vulnerable to a shoulder surfing attack, which is based on the user's input and can be interpreted by looking at the movement of the shoulder, and the smudge attack is also vulnerable due to fingerprint drag marks remaining on the mobile phone pad. Therefore, in this paper, we want to add a new security method to check the pressed time by using a thread in the pattern locking scheme to secure the vulnerability. It is divided into short, middle, and long click according to the pressing time at each point. When dragging using the technique, security performance enhances $3^n$ tiems. Therefore, even if dragging in the same 'ㄱ' manner, it becomes a completely different pattern depending on the pressing time at each point.

• Journal of Korea Multimedia Society
• /
• v.18 no.1
• /
• pp.71-80
• /
• 2015

Many researches have been studied to overcome the weak points in authentication schemes of mobile devices such as pattern-authentication that is vulnerable for smudge-attack. Since random-pattern-lock authenticates users by drawing figure of predefined-shape, it can be a method for robust security. However, the authentication performance of random-pattern-lock is influenced by input noise and individual characteristics sign pattern. We introduce an optimization method of user input direction to increase the authentication accuracy of random-pattern-lock. The method uses the likelihood of each direction given an data which is angles of line drawing by user. We adjusted recognition range for each direction and achieved the authentication rate of 95.60%.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.2
• /
• pp.233-240
• /
• 2017

Fingerprint authentication identifies individuals based on user specific information. It is widely used as it is convenient, secure and has no risk of leakage, loss, or forgotten. However, the latent fingerprints remaining on the smart device's surface are vulnerable to smudge attacks. We analyze the usage patterns of individuals using smart device and propose methods to reconstruct damaged fingerprint images using fingerprint smudges. We examine the feasibility of smudge attacks with frequent usage situations by reconstructing fingerprint smudges collected from touch screens. Finally, we empirically verify the vulnerability of fingerprint authentication systems by showing high attack rates.

• KIPS Transactions on Computer and Communication Systems
• /
• v.7 no.3
• /
• pp.73-80
• /
• 2018

Due to the popularity of smartphones and the simplification of financial services, the number of mobile financial services is increasing. However, the security keypads developed for existing financial services are susceptible to probability analysis attacks and have security vulnerabilities. In this paper, we propose and implement a security keypad based on dual touch. Prior to the proposal, we examined the existing types of security keypads used in the mobile banking and mobile payment systems of Korean mobile financial businesses and analyzed the vulnerabilities. In addition, we compared the security of the proposed dual touch keypad as well as existing keypads using the authentication framework and the existing keypad attack types (Brute Force Attack, Smudge Attack, Key Logging Attack, and Shoulder Surfing Attack, Joseph Bonneau). Based on the results, we can confirm that the proposed security keypad with dual touch presented in this paper shows a high level of security. The security keypad with dual touch can provide more secure financial services, and it can be applied to other mobile services to enhance their security.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.9
• /
• pp.4560-4575
• /
• 2018

Since smartphone contains various personal data, security is one of the important aspects in smartphone technologies. Up to now, various authentication techniques have been proposed to protect smartphones. The pattern lock on the Android system is one of the most widely used authentication methods for low-cost devices but it is known to be vulnerable to smudge attack or shoulder surfing attack. LG's smartphone uses its own technique, which is called "Knock Code." The knock code completes the authentication by touching the user defined area in turn on the screen. In this paper, we propose the new, enhanced version of knock code by adding the sliding operation and by using flexible area recognition. We conducted security analysis, which shows that under the same password size, the search space is overwhelmingly larger than the original algorithm. Also, by using the sliding operation, the proposed scheme shows resilience against smudge attacks. We implemented the prototype of our scheme. Experimental results show that compared with the original Knock Code and Android pattern lock, our scheme is more convenient while providing better security.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.11
• /
• pp.1471-1477
• /
• 2019

Currently, there are various security methods in smart phone. Among them, pin number and pattern lock were used long as they were used from early smart phone. However, security is weak that much. The security of pin number is slightly high, but the security of conventional pattern lock remains moderate. However, the conventional pattern lock is still used by several people because of convenience. This is because some users' smart phones don't support biometric security. The most convenient security method for devices that don't support biometric security is pattern lock. However, this method is vulnerable to shoulder surfing attack and smudge attack. Therefore, we introduce random pattern lock that solves the vulnerability of the conventional pattern lock while maintaining the convenience of the pattern lock. This is a lock method that places each point placed on the screen in a circular shape and assigns a random number to it. Therefore, If this is introduced, It's expected to solve vulnerability.