Multi-Touch Authentication on Tabletops

Multi-Touch Authentication on Tabletops. Video demonstration of the authentication techniques ShieldPIN, SlotPIN, CuePIN, Color-Rings, and Pressure-Grid. Newcastle University, Newcastle upon Tyne, UK

Computing in public spaces has become common due to the increasing ubiquity of mobile computing and portable computers with the capability of Internet connectivity “anywhere”, “anytime”. However, when performing security-sensitive tasks on these devices in public, both passive and active observers are given an opportunity to eavesdrop on this information. This is particularly critical for authentication; alphanumeric passwords and personal identification numbers (PINs) are multi-platform authentication mechanisms. However, as both are based on "something you know", it is relatively easy for an attacker to replicate the authentication process after observing the user’s input, or on-screen content.

The introduction of digital tabletop interfaces, such as Microsoft Surface have given rise to the need to develop secure and usable authentication techniques that are appropriate for the co-located collaborative settings for which they have been designed. It is inevitable that applications naturally evolve to require authentication, and in their current form, PINs and passwords are more vulnerable to observation than in more conventional contexts. Observation could be restricted by simply shielding the input of the credentials with a hand. However, people respond to a social imperative that makes it difficult for them to signal an explicit mistrust of colleagues. This calls for particular design of schemes for this new context...

Authentication Techniques

We explored the design space for authentication techniques that leverages a number of qualities available on multi-touch displays and designed five new authentication techniques for digital tabletops addressing the issues mentioned above.

The physicality and directness of touch interaction allows a user to directly touch and interact with virtual interface elements that exploit direct physical metaphors -- which could improve usability and comprehension of underlying security mechanisms.

We tried to hamper observation of the authentication process by interfering with one or more steps in the observer’s processes of sense making and knowledge acquisition.