IEEE Consumer Electronics Magazine - January/February 2022 - 27

numbers or images given by the server to get
authenticated.
Biometric techniques come under the category
of " something you are " authentication factor
and are divided into two approaches, i.e.,
physiological and behavioral biometrics; it
requires additional hardware (e.g., fingerprint
scanners). In comparison, behavioral biometrics
is used more commonly for continuous authentication.3
Such methods, as the term behavioral
implies, are focused on behavioral signals from
the users, and authentication that occurs implicitly,
i.e., gait and touch dynamics are calculated
by sensors. Authentication based on biometrics
differentiates individuals by their special biometric
properties.4 Unlike biometric technique,
this article adopts " something you process " factor
of authentication. Thus, this article proposed
a multifactor behavioral pattern lock scheme.
First, the user has to calculate the values of the
pattern by using " something you process " factor
of authentication. Second, the user has to draw
the pattern, the user gets authenticated only if
the touch dynamics features of the user match
the features saved in the system. The key contributions
of this article are as follows.
Developed an efficient and secure authentication
system for consumers' devices, which
can protect the user credentials in public places
even in the presence of recording
cameras.
Utilized the idea of " something user processes, "
which allows the user to enter a new
pattern on each login session, thus enhances
the security against guessing attack, smudge
attack, and shoulder surfer.
Proposed a multifactor behavioral authentication
method.
PROBLEM STATEMENT AND ATTACK
MODEL
Owing to the continuously growing popularity
of smartphones, the cybersecurity landscape
has undergone rapid changes. To protect the
sensitive mobile data and applications, the
authentication approaches have been dominated
by alphanumerical passwords and graphical
methods.5 Using the password or pattern in
January/February 2022
Figure 1. Shoulder-surfing attack: Adversary tries to
obtain login information by visual means.
the public area may reveal the password to an
intruder unknowingly.
Attack Models
Shoulder surfing and smudge attacks have
attained more attention in recent years.6
Shoulder-Surfing Attack Shoulder surfing is
a social engineering act used to obtain information,
such as PINs, passwords, and other confidential
data by looking over the user's
shoulder,7 as shown in Figure 1. There are two
types of shoulder-surfing attacks. 1) Weak shoulder
surfing is an attack where the attacker can
get the user's information using his/her naked
eye. 2) Strong shoulder surfing is an attack
where the attacker uses any recording device to
get the user details and credentials.
Smudge Attack A smudge attack is a technique
to get the password or unlock-pattern of a
touchscreen gadget, by exploiting the oily residues
or smudges on the screen.8 The strategy
was explored by a group of researchers at the
University of Pennsylvania.8 The attacker can
get an idea of the user's password easily by discerning
the smudge left on the touchscreen, as
shown in Figure 2.
OPERATIONAL GRID (OP-GRID)
To overcome the weakness of the pattern
lock system, the proposed scheme takes the fifth
level of authentication factor and provides a
graphical authentication system called OP-Grid.
As discussed earlier, this factor of authentication
requires the user to process a predefined
27
IEEE Consumer Electronics Magazine - January/February 2022

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - January/February 2022
