Dynamic Passcode Segment Selection for Shoulder Surfing Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional passcode entry systems are vulnerable to attacks due to finger oil accumulation and shoulder surfing, as they rely on visible PINs or patterns that can be easily compromised.
Innovation Solution
A method that presents a subset of passcode segments along with distractor segments to the user, requiring selection of only the passcode segments from a dynamically generated presentation set, which includes both passcode and distractor elements, to enhance security and prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a visible PIN or pattern is used for authentication, then the authentication process is simple and fast, but the system becomes vulnerable to finger oil accumulation and shoulder surfing attacks
Solution Approach 1:
The authentication system is divided into two independent components: a secret passcode known only to the user and a visual presentation layer displayed on screen. The passcode is segmented into individual segments that are presented in random positions among distractor segments, preventing attackers from seeing the complete passcode sequence while maintaining user convenience.
Solution Approach 2:
A visual presentation layer acts as an intermediary between the user's knowledge of the passcode and the authentication system's verification process. This intermediary randomly positions passcode segments among distractor segments on the display, obscuring the actual passcode from potential attackers while still allowing the legitimate user to authenticate.
2Ease of operation
If the complete passcode is displayed to the user, then the user can easily enter it, but attackers can observe and deduce the correct sequence through shoulder surfing
Solution Approach 1:
The harmful visual information (complete passcode display) is extracted and replaced with a selective presentation system. Only specific segments of the passcode are displayed at specific times in random positions among distractor segments, taking out the vulnerability of complete display while preserving the necessary authentication function.
Solution Approach 2:
The presentation of passcode segments is made dynamic rather than static. The positions, timing, and selection of which segments to display change with each authentication attempt, preventing attackers from observing a fixed pattern or deducing the complete passcode through repeated viewing.
3Object-affected harmful factors
If distractor segments are added to the presentation set, then security against shoulder surfing is improved, but the complexity of the authentication interface increases
Solution Approach 1:
Different segments of the display serve different functions: some positions contain passcode segments while others contain distractor segments. The system applies different qualities to different parts of the interface - passcode segments are interactive and meaningful, while distractor segments are non-interactive decoys. This local differentiation provides security without requiring complete redesign of the entire interface.
Data Source
Figure 1
Figure 1A
Figure 2~3
AI summary
Authentication in a system includes presenting information to a user containing a partial sequence of a passcode along with distractors. The user is challenged to identify the partial sequence from among the information in order to gain access to the system.