Use Your Illusion: Secure Authentication Usable Anywhere Eiji Hayashi Nicolas Christin Rachna Dhamija Adrian Perrig Carnegie Mellon CyLab Japan The reason why the title is cognitive process

Key Concept: Distortion Distorted Picture Original Picture Ask You can recognize a baby now because you know the original picture

Use Your Illusion

Graphical Authentication Passfaces Pass Points DAS (Draw-A-Secret) Déjà vu

Passfaces Faces are used as a graphical portfolio Preference could be a limitation bias Cited from “On User Choice in Graphical Password Schemes”, Darren Daivis et. al, 2004

Pass Points Use “a sequence of clicks” as a shared secret There are hot spots color Cited from “Authentication Usin Graphical Passwords: Basic Results”, Susan Wiednbeck et. al, 2004

Most Straightforward Way Choose graphical portfolio from a set of pictures

Graphical Portfolio If a user can choose whatever graphical portfolio… If system assigns portfolio randomly…

Fundamental Tradeoff Security Memorability

“Use Your Illusion” Allow users to take/choose pictures by themselves Distort the pictures Assign the distorted pictures as graphical portfolio

“Use Your Illusion” Security Memorability Allow users to take/choose pictures by themselves Distort the pictures Assign the Distorted pictures as graphical token Security Memorability

Requirements for Distortion One-way Discarding precise shapes and colors Preserving rough shapes and colors

Oil Painting Filter Choose RGB values which appears most frequently in a neighborhood

Oil Painting Filter

Distortion Level If high, difficult to guess but difficult to memorize If low, easy to memorize but easy to guess Brush size and bins are mathematical parameter

Distortion Level Security Memorability Two parameters affect distortion level If too high, not usable If too low, not secure Security Brush size and bins are mathematical parameter Memorability

Low-Fidelity Test Least distorted color Most distorted

Low-Fidelity Test animation

Low-Fidelity Test animation

Low-Fidelity Test animation

Low-Fidelity Test animation

Low-Fidelity Test animation

Low-Fidelity Test It’s a dog!! animation

Low-Fidelity Test Difficult to guess w/o knowing original picture

Low-Fidelity Test Can’t recognize a dog

Low-Fidelity Test Easy to recognize w/ knowing original picture

Low-Fidelity Test Satisfies requirements

Prototype Implemented on Nokia’s cell-phone for usability test Also implemented on the web

Prototype Demo

Usability Test 45 participants and for 1 week 54 participants and for 4 weeks

1st Usability Test 45 participants were divided into 3 groups Self-selected, Non-distorted Self-selected, distorted (Use Your Illusion) Imposed, highly-distorted

Self-selected, Non-distorted

Self-selected, Distorted

Imposed, Highly-distorted State simply

Procedure Date Task Before the 1st day Take 3 pictures The 1st day Memorize portfolio Practice Authenticate 2 days after 1 week after Fill out questionnaires

Success Rate The 1st day 2 days after 1 week after 100% (15) 93.3% Self-selected, Non-distorted 100% (15) Distorted Imposed, Highly-distorted 93.3% (14) 73.3% (11)

Authentication Time (Mean) Imposed, Highly-distorted Self-selected, Distorted Self-selected, Non-distorted

Process of Memorization Participants assign meanings to distorted pictures Assigning meanings helps memorization Mountain Sea Moai statue

2nd Usability Test 54 participants were divided into 3 groups Self-selected, Non-distorted Self-selected, Distorted Imposed, Distorted Authenticate On the 1st day 2 days after 1 week after 4 weeks after Done in Japan Minolity between

Imposed, Distorted

Success Rate The 1st day 2 days after 1 week after 4 weeks after 100% Self-selected, Non-distorted 100% (18) Distorted Imposed, 89% (16) 94% (17)

Authentication Time (Mean) Imposed, Distorted Self-selected, Distorted Later, I will think about this slide more. Self-selected, Non-distorted

Tolerance against Guessing Attack Original pictures are vulnerable Distorted pictures are more tolerant Define guessing attack Attacker is very good at getting information about a user Preference

Future Work Detailed usability test Long term test Find an optimal distortion Investigate a metric evaluating distortion level

Use Your Illusion Use distorted pictures as a portfolio As memorable as non-distorted pictures More memorable than imposed (highly-) distorted pictures Fits human memorization process More tolerant to guessing attack photo

Thank you for listening Prototype is available on http://arima.okoze.net/illusion/ Please try it! URL