PaperlayerView exact revision on arXiv

Source-linked AI summary

User-Generated Free-Form Gestures for Authentication: Security and Memorability

Michael Sherman, Gradeigh Clark, Yulong Yang, Shridatt Sugrim, Arttu Modig, Janne Lindqvist, Antti Oulasvirta, Teemu Roos

arXiv:1401.0561v1cs.CRcs.HC

TL;DR

Free-form multitouch gestures lack security metrics suited to continuous, user-generated passwords. The paper adapts a mutual-information metric and studies gestures with repeated trials and a recognizer. Multi-finger gestures had lower measured security in the dataset, while estimated information dropped after a delay.

  • Problem

    Existing entropy-based password metrics do not capture the security and memorability of continuous free-form gestures, and the paper identifies no information-theoretic security metric for multitouch gestures as passwords.

    Source: §1 · p. 1

  • Method

    The authors adapt mutual information between repeated gestures and use a generate-test-retest study, a multitouch recognizer, and a shoulder-surfing study.

    Source: §1 · p. 2, §3 · p. 4, §7 · p. 12

  • Results

    Multi-finger gestures did not show high measured security, and estimated information content dropped by 15.66 percent after an interval of >10 days.

    Source: §7 · p. 12

  • Takeaways & Limitations

    The authors conclude that free-form gestures can work as passwords in a practical authentication system and show potential against shoulder-surfing attacks.

    Source: §1 · p. 2, §7 · p. 12

    The recognizer leaves rotation, scale, and position invariance as future considerations.

    Source: §7 · p. 13

Abstract

from arXiv · show

This paper studies the security and memorability of free-form multitouch gestures for mobile authentication. Towards this end, we collected a dataset with a generate-test-retest paradigm where participants (N=63) generated free-form gestures, repeated them, and were later retested for memory. Half of the participants decided to generate one-finger gestures, and the other half generated multi-finger gestures. Although there has been recent work on template-based gestures, there are yet no metrics to analyze security of either template or free-form gestures. For example, entropy-based metrics used for text-based passwords are not suitable for capturing the security and memorability of free-form gestures. Hence, we modify a recently proposed metric for analyzing information capacity of continuous full-body movements for this purpose. Our metric computed estimated mutual information in repeated sets of gestures. Surprisingly, one-finger gestures had higher average mutual information. Gestures with many hard angles and turns had the highest mutual information. The best-remembered gestures included signatures and simple angular shapes. We also implemented a multitouch recognizer to evaluate the practicality of free-form gestures in a real authentication system and how they perform against shoulder surfing attacks. We conclude the paper with strategies for generating secure and memorable free-form gestures, which present a robust method for mobile authentication.

1. INTRODUCTION

The paper examines free-form multitouch gestures as mobile passwords, addressing limits of grid-based gestures and the lack of security metrics suited to continuous, user-generated gestures. It studies their security and memorability and implements a recognizer to assess practical authentication and shoulder-surfing resistance.

1. INTRODUCTION

  • Grid-based patterns are vulnerable to shoulder surfing and smudge attacks, while prior gesture studies focused on template gestures rather than user-generated free-form passwords.The paper identifies a gap in understanding the security of free-form gestures chosen by users.Source: §1 · pp. 1–2
  • Free-form gestures use a blank screen without a grid or template, allowing arbitrary shapes and potentially more information through multiple fingers.Gestures may be scale- and position-invariant, allowing users to gesture without visually attending to the display; mnemonic cues can still aid generation.Source: §1 · pp. 1–2
  • The study measures information capacity and memorability using a generate-test-retest experiment with 63 participants, including recall after at least 10 days.The design examines how time affects recall of freely chosen gestures.Source: §1 · p. 2
  • The authors adapt mutual information for repeated multitouch trajectories because standard information metrics do not directly fit continuous gestures and their variability.The metric separates intended, reproducible features from uncontrolled, unreproducible variation.Source: §1 · p. 2
  • Several participants created secure and memorable gestures without guidance or prior practice, but many multi-finger gestures merely repeated the same simple gesture.The authors also implemented a practical multitouch recognizer and conducted a preliminary shoulder-surfing study.Source: §1 · p. 2

2. RELATED WORK

Prior work covers gesture recognition, protection against specific attacks, and indirect security measures, but largely does not measure the security content of user-generated free-form gestures. The paper situates its approach alongside biometric, graphical-password, and continuous-movement research.

2. RELATED WORK

  • Gesture-authentication research has studied recognition and protection from specific attacks, but has focused on repeated template gestures rather than user-generated free-form gestures.Some work assesses difficulty of reproducing a gesture rather than its security content.Source: §2 · pp. 2–3
  • Prior biometric-rich authentication work uses user-specific gesture or interaction features for identification, while 3D gesture recognition has used cameras and wireless signals.The paper distinguishes its focus on the information content of user-generated 2D gestures as passwords.Source: §2 · pp. 2–3
  • Graphical-password research includes dictionary-attack models and studies of password memorability, while prior work also examines shoulder-surfing and brute-force attacks on gestures.These approaches do not directly measure the security content of a free-form gesture itself.Source: §2 · p. 3
  • The authors adapt information-capacity work on continuous full-body movement, which did not study 2D gestures, authentication, security, or memorability.Earlier non-security gesture work found that people often repeat familiar, context-dependent gestures.Source: §2 · p. 3

3. SECURITY OF GESTURES

The paper proposes an information-theoretic metric for continuous gestures, using mutual information between repetitions to capture reproducible gesture content while discounting uncontrolled variation. Its processing aligns and reduces movement data before estimating mutual information.

3. SECURITY OF GESTURES

  • The metric estimates gesture information content from mutual information between two realizations of the same gesture, assuming shared dependencies are intended and differences are unintended.This addresses the challenge of separating intended complexity from non-reproducible variation in continuous movement.Source: §3 · pp. 3–4
  • The metric takes two repeated multitouch movement sequences as input, with trajectories recording each used finger’s locations over the gesture.The paper frames the measure as an information-theoretic association between gesture security and gesture information content.Source: §3 · p. 4
  • Second-order autoregressive models remove predictable movement; their residuals represent deviations from constant movement and can gauge trajectory surprisingness.The model’s interpretability rests on the idea that constant movement contains no information once direction and velocity are determined.Source: §3 · p. 4
  • PCA reduces dependent multitouch features before their information content is summed, so fixed-constellation fingers do not simply add redundant information.The retained dimensions are selected to keep reprojection error acceptably low.Source: §3 · p. 4
  • Canonical Time Warping can align gesture sequences of unequal length by duplicating frames, which are skipped when computing mutual information.This avoids inflating the effect of duplicated frames.Source: §3 · p. 4
  • The metric’s Gaussian-model mutual information is invariant to linear transformations and supports comparisons across gesture lengths, finger counts, and screen sizes in bits.The authors note that low screen resolution can still prevent important gesture details from being recorded.Source: §3 · p. 5

4. METHOD

The study used a two-session generate-test-retest design: participants created and repeated a gesture, recalled it after a short distraction, and returned at least 10 days later for another recall session. The same tablet and gesture application were used throughout.

4. METHOD

  • The study recruited 63 touchscreen-familiar adults aged 18–65; all completed the first session and 57 returned for the second.Participants used a Google Nexus 10 tablet recording at an average of 200 frames per second.Source: §4 · p. 5
  • Gesture files were resampled from the tablet’s approximately 200 FPS rate to 60 FPS using cubic-spline interpolation to reduce uneven sampling effects.The preprocessing also detected finger-order errors between trials and corrected them by comparing starting coordinates.Source: §4 · pp. 5–6
  • Participants created a gesture they thought others could not guess but they could remember, then repeated it nine more times on a blank screen.They could retry until satisfied; the number of fingers could not change during a gesture, and the completed trace was displayed for verification.Source: §4 · p. 6
  • After a mental-rotation and counting distraction, participants recalled the gesture twice; at the second session, they recalled it five times after at least 10 days.The study collected workload ratings and a short survey about recall.Source: §4 · pp. 5–6

5. RESULTS

Across repeated gestures, estimated mutual information (ˆI) changed with practice and recall, and differed by gesture characteristics and finger use. Memorability and subjective workload also varied, while execution consistency and task practice shaped the observed results.

5. RESULTS

  • The study recorded 1,038 gesture repetitions, with ˆI reported as the mean across relevant repetition pairs.Six participants missed session two, and three additional traces were incomplete.Source: §5 · p. 6, Table 1 · p. 6

5.1 Factors Affecting Security

  • ˆI fell from around 35 to 27 bits for single-finger gestures and 20 to 15 bits for multifinger gestures by recall, with the sharpest drop at Recall1.The decrease between Generate and Recall1 was more severe for single-finger gestures; between Recalls 1 and 2 it was more severe for multifinger gestures.Source: §5.1 · pp. 6–7, Figure 2 · p. 6
  • ˆI increased with gesture duration but explained only 5% of its variation; the highest-ˆI gestures lasted over 2 seconds.The highest-ˆI gestures lasted between 2 and 5 seconds, while long duration could reflect either careful complexity or limited practice.Source: §5.1 · p. 7, Figure 3 · p. 7
  • The highest-ˆI gestures were angular paths with hard turns or signatures, while low-scoring gestures often had gentle curves or copied multifinger traces.Across categories, the top five gestures overlapped substantially, yielding nine unique gestures.Source: §5.1 · p. 7, Figure 5 · p. 7

5.2 Security of Multitouch Gestures

  • 32 participants chose multifinger gestures and 31 chose single-finger gestures, yet single-finger gestures had higher mean ˆI; finger count explained only 11.8% of variance in Generate.The finger-count effect was significant for Generate (b = 17.948, t(57) = 2.763, p = .0077), but not Recall2 (b = 11.898, t(57) = 1.841, p = .07).Source: §5.2 · p. 8, Figure 6 · p. 8

5.3 Factors Affecting Memorability

  • The best-remembered gestures were shorter and simpler than the highest-security gestures, and memorability showed minimal dependence on the delay between sessions.The delay relationship had r2 < 0.03.Source: §5.3 · p. 8, Figure 8 · p. 8

5.4 Individual Differences

  • Only three participants used substantially different finger paths; errors such as inconsistent finger order and between-session rotation accompanied poor scores.The researchers fixed inconsistent finger order during preprocessing, and gestures with cross-session rotation also scored poorly within sessions.Source: §5.4 · pp. 8–9

5.5 Subjective Task Load Assessment Analysis

  • Except for Frustration, all TLX items differed significantly between sessions, and participants likely found recall less demanding than creation.Session-two mean scores were lower; increased practice or familiarity may explain the difference.Source: §5.5 · p. 9, Table 2 · p. 9, Figure 9 · p. 9

6. PRACTICAL AUTHENTICATION SYSTEM IMPLEMENTATION

The authors extend Protractor for multitouch authentication and evaluate recognition accuracy and shoulder-surfing resistance. Recognition error decreases with more templates, while a preliminary trial found attacker scores separable from the target’s.

6. PRACTICAL AUTHENTICATION SYSTEM IMPLEMENTATION

  • The recognizer matches input gestures against stored templates under location, scale, and rotation invariance assumptions, which designers can restrict or relax.Location and scale invariance support cross-platform use; rotation invariance reduces computational complexity for individualized gestures.Source: §6 · pp. 9–10
  • The multitouch extension applies Protractor separately to corresponding fingers, averages their scores, and immediately rejects gestures with the wrong finger count.The implementation was motivated by the need for low computational complexity, speed, and low error per template on mobile devices.Source: §6 · p. 10

6.1 Recognizer Performance

  • The study used ten initial repetitions as templates and evaluated two recall sets: after a mental task and after at least ten days.ROC curves were generated by varying the authentication threshold; EER is where true-positive and false-positive rates are equal.Source: §6 · p. 10, §6.1 · p. 11
  • 3.34% and 13.16% were the best EERs with 10 templates for the first and second data sets, respectively; higher second-set error reflected recall problems, not recognizer weakness.EER decreased as template count increased, with slower reductions at six templates identified as an ideal starting point for user training.Source: §6.1 · p. 11, Table 3 · p. 11

6.2 Shoulder Surfing Attack Trial

  • The shoulder-surfing trial used seven experienced volunteers, three target gestures, and videos shown once to each attacker before five replication attempts.A Latin-square video order was used to limit order effects.Source: §6.2 · pp. 11–12
  • No attacker scores overlapped with the target’s across three gestures, and the closest attempt remained below a suitable authentication threshold.The authors report that a passing score can be set so the target authenticates while attackers do not.Source: §6.2 · p. 12, Table 4 · p. 12

7. DISCUSSION AND CONCLUSIONS

Overall, the results favor user-generated free-form gestures as touchscreen authentication, while showing that measured security depends on gesture form and memorability varies with repetition and delay.

7. DISCUSSION AND CONCLUSIONS

  • Estimated ˆI was high enough for most generated passwords, while multifinger gestures did not show high security in this measure.Most multifinger gestures repeated a simple shape, suggesting participants may have overestimated the security gained merely by adding fingers.Source: §7 · p. 12
  • Gestures lasting less than two seconds had average ˆI less than 2% below the average for all gestures, and duration did not play an important role in ˆI.Some simple shapes took longer to complete than complex gestures such as signatures.Source: §7 · p. 12
  • Signatures achieved very high ˆI, and participants repeated them well despite their complexity.The authors suggest a secure gesture should combine inherent complexity with ease of performance.Source: §7 · p. 12
  • After an interval of more than 10 days, ˆI dropped by 15.66%, though gestures remained recognizable as unique passwords; repeated performance tended to stabilize ˆI.Gesture variability across attempts complicates reporting security as a single exact value; the authors suggest considering a range.Source: §7 · pp. 12–13
  • The authors offer practice and consistency advice, including trying different gestures, choosing one for frequent use, and repeating traces carefully.They plan to develop and test these guidelines in further studies.Source: §7 · p. 13
  • For higher ˆI, the authors recommend many sharp turns and familiar gestures such as signatures, while avoiding few, gentle, or same-direction turns.When adding fingers, they recommend different motions and avoiding the same finger-down order or finger count each time.Source: §7 · p. 13
  • Recognizer scores were 3–9 for own-template comparisons versus 0–1 for other templates; lowest EERs were 3.34% and 13.16% across the two sets.The authors identify differing trial counts and a longer interval before the second set as factors in the disparity; rotation, scale, and position invariance remain for future consideration.Source: §7 · p. 13
  • In a preliminary shoulder-surfing trial, no attacker repeated a gesture well enough for system acceptance, but broader studies were warranted.The authors suggest testing attackers with more opportunities, including repeated viewings of recordings.Source: §7 · p. 13
Loading 1401.0561v1…