1. Use Your Illusion: Secure Authentication Usable Anywhere
Eiji Hayashi
Nicolas Christin
Rachna Dhamija
Adrian Perrig
Carnegie Mellon CyLab Japan
The reason why the title is cognitive process

2. Key Concept: Distortion
Distorted Picture
Original Picture
Ask
You can recognize a baby now
because you know the original picture

3. Use Your Illusion

4. Graphical Authentication
Passfaces
Pass Points
DAS (Draw-A-Secret)
Déjà vu

5. Passfaces Faces are used as a graphical portfolio
Preference could be a limitation
bias
Cited from “On User Choice in Graphical Password Schemes”, Darren Daivis et. al, 2004

6. Pass Points Use “a sequence of clicks” as a shared secret
There are hot spots
color
Cited from “Authentication Usin Graphical Passwords: Basic Results”, Susan Wiednbeck et. al, 2004

7. Most Straightforward Way
Choose graphical portfolio from a set of pictures

8. Graphical Portfolio If a user can choose whatever graphical portfolio…
If system assigns portfolio randomly…

9. Fundamental Tradeoff
Security
Memorability

10. “Use Your Illusion” Allow users to take/choose pictures by themselves
Distort the pictures
Assign the distorted pictures as graphical portfolio

11. “Use Your Illusion” Security Memorability
Allow users to take/choose pictures by themselves
Distort the pictures
Assign the Distorted pictures as graphical token
Security
Memorability

12. Requirements for Distortion
One-way
Discarding precise shapes and colors
Preserving rough shapes and colors

13. Oil Painting Filter
Choose RGB values which appears most frequently in a neighborhood

14. Oil Painting Filter

15. Distortion Level If high, difficult to guess but difficult to memorize
If low, easy to memorize but easy to guess
Brush size and bins are mathematical parameter

16. Distortion Level Security Memorability
Two parameters affect distortion level
If too high, not usable
If too low, not secure
Security
Brush size and bins are mathematical parameter
Memorability

17. Low-Fidelity Test
Least distorted
color
Most distorted

18. Low-Fidelity Test
animation

19. Low-Fidelity Test
animation

20. Low-Fidelity Test
animation

21. Low-Fidelity Test
animation

22. Low-Fidelity Test
animation

23. Low-Fidelity Test
It’s a dog!!
animation

24. Low-Fidelity Test
Difficult to guess
w/o knowing original
picture

25. Low-Fidelity Test
Can’t recognize a dog

26. Low-Fidelity Test
Easy to recognize
w/ knowing original
picture

27. Low-Fidelity Test
Satisfies
requirements

28. Prototype Implemented on Nokia’s cell-phone for usability test
Also implemented on the web

29. Prototype
Demo

30. Usability Test 45 participants and for 1 week
54 participants and for 4 weeks

31. 1st Usability Test 45 participants were divided into 3 groups
Self-selected, Non-distorted
Self-selected, distorted (Use Your Illusion)
Imposed, highly-distorted

32. Self-selected, Non-distorted

33. Self-selected, Distorted

34. Imposed, Highly-distorted
State simply

35. Procedure Date Task Before the 1st day Take 3 pictures The 1st day
Memorize portfolio
Practice
Authenticate
2 days after
1 week after
Fill out questionnaires

36. Success Rate The 1st day 2 days after 1 week after 100% (15) 93.3%
Self-selected,
Non-distorted
100%
(15)
Distorted
Imposed,
Highly-distorted
93.3%
(14)
73.3%
(11)

37. Authentication Time (Mean)
Imposed,
Highly-distorted
Self-selected,
Distorted
Self-selected,
Non-distorted

38. Process of Memorization
Participants assign meanings to distorted pictures
Assigning meanings helps memorization
Mountain
Sea
Moai statue

39. 2nd Usability Test 54 participants were divided into 3 groups
Self-selected, Non-distorted
Self-selected, Distorted
Imposed, Distorted
Authenticate
On the 1st day
2 days after
1 week after
4 weeks after
Done in Japan
Minolity
between

40. Imposed, Distorted

41. Success Rate The 1st day 2 days after 1 week after 4 weeks after 100%
Self-selected,
Non-distorted
100%
(18)
Distorted
Imposed,
89%
(16)
94%
(17)

42. Authentication Time (Mean)
Imposed,
Distorted
Self-selected,
Distorted
Later, I will think about this slide more.
Self-selected, Non-distorted

43. Tolerance against Guessing Attack
Original pictures are vulnerable
Distorted pictures are more tolerant
Define guessing attack
Attacker is very good at getting information about a user
Preference

44. Future Work Detailed usability test Long term test
Find an optimal distortion
Investigate a metric evaluating distortion level

45. Use Your Illusion Use distorted pictures as a portfolio
As memorable as non-distorted pictures
More memorable than imposed (highly-) distorted pictures
Fits human memorization process
More tolerant to guessing attack
photo

46. Thank you for listening
Prototype is available on
Please try it!
URL