ShakeUnlock: Securely Transfer Authentication States Between Mobile Devices

TitleShakeUnlock: Securely Transfer Authentication States Between Mobile Devices
Publication TypeJournal Article
Year of Publication2017
AuthorsFindling, RD, Muaaz, M, Hintze, D, Mayrhofer, R
JournalIEEE Transactions on Mobile Computing (IEEE TMC)
Volume16
Issue4
Start Page1163
Pagination1175
Date Published04/2017
ISSN1536-1233
Keywordsauthentication, Mobile environments, Security and Privacy Protection, Time series analysis
Abstract

As users start carrying multiple mobile devices, we propose a novel, token based mobile device unlocking approach. Mobile devices are conjointly shaken to transfer the authentication state from an unlocked token device to another device to unlock it. A common use case features a wrist watch as token device, which remains unlocked as long as it is strapped to the user's wrist, and a locked mobile phone, which is unlocked if both devices are shaken conjointly. Shaking can be done single-handedly, requires little user attention (users don't have to look at the device for unlocking it) and does not cause additional cognitive load on users. In case attackers gain control over the locked phone, forging shaking is difficult, which impedes malicious unlocks. We evaluate our approach using acceleration records from our 29 people sized ShakeUnlock database and discuss influence of its constituent parts on the system performance. We further present a performance study using an Android implementation and live data, which shows the true negative rate of observational attacks to be in the range of 0.8 - if an attacker manages to gain control over the locked device and shake it in parallel to the device owner shaking the token device.

URLhttp://ieeexplore.ieee.org/document/7494938/
DOI10.1109/TMC.2016.2582489
Refereed DesignationRefereed
yorandomusmilelink