H4Plock: Supporting Mobile User Authentication through Gestural Input and Tactile Output

We have developed a novel authentication mechanism, H4Plock (pronounced “Hap-lock”), that leverages gestural input and tactile feedback to defend against casual observation attacks. Users enter up to four on-screen gestures based on receiving tactile prompts, in the form of vibrations, from the mobile device. These prompts inform the user as to which gestures should be entered. The style of vibrations, e.g., short versus long, indicate the specific gestures that should be entered from a previously chosen primary or secondary passcode. As a result, the sequence of gestures will vary on each authentication attempt, reducing the capability of an attacker to “shoulder surf” and accurately recreate the authentication process. We developed a protype of the application and conducted an IRB approved pilot study. Findings show that 94% of participants were able to properly authenticate using H4Plock, with 73% successfully accessing the system after a gap of five days without rehearsal. We also examined the security of the H4Plock where participants were asked to recreate passcodes through a video replay, simulating a shoulder surfing attack scenario. Even after direct observations, only 25% of the pascodes could be successfully recreated.