Three-Level Pressure-Based Authentication on Touch Screens

Abstract

Since pressure is invisible in nature, it has been applied to enhance the authentication security. However, previous work focused on only two-level pressure detection, which makes it feasible for an attacker to guess a pressure level from a user's pressing behavior in the shoulder surfing attack. To mitigate the above risk, this article extends pressure-based authentication from two levels to three levels. It systematically evaluates its usability and security with 98 young adults in a mid-west university in two user studies. The first study with 67 participants showed that a three-level pressure-based password did not increase the difficulty of memorization, and it was more resistant to the shoulder surfing attack than a two-level pressure-based password (two-level = 79.39% successful attacks versus three-level = 44.71% successful attacks). However, three-level passwords have a higher false negative rate than two-level passwords, which implies that users lack a consistent pressing pattern on the medium level. To address the above issue, we designed an adaptive training process that assists users in forming a consistent pressing pattern. The training process features an automatic detection of consistent pressing patterns, which potentially reduces the training length. The second user study, with 31 participants, indicated that the false negative rate in three-level passwords is decreased significantly after the training from 59.90% to 2.15%, while maintaining a reasonable false acceptance rate of 20%.