기계 학습 기반의 자동화된 스머지 공격과 패턴락 시스템 안전성 분석
Automated Smudge Attacks Based on Machine Learning and Security Analysis of Pattern Lock Systems
1
조회
0
다운로드
3
인용
0
참고문헌
키워드
초록
터치스크린 기반 스마트 기기가 널리 보급 되면서 모바일 환경을 위한 주요 인증 메커니즘으로 그래픽 패스워드 기법중 하나인 패턴 락 시스템이 등장했다. 사용자가 잠금 해제를 위하여 패턴 락을 사용한 후의 남아있는 패턴 모양의 흔적은 스머지 공격에 취약하다. 이러한 스머지 공격에 대응하기 위하여 TinyLock을 포함한 다양한 패턴 락이 제안되었다. 본 논문에서는 스머지 공격이 발생할 수 있는 환경에서 획득한 스머지 패턴 이미지를 이용하여 기계 학습을 통한자동화된 스머지 공격의 유효성에 대하여 실험하고 안드로이드 패턴 락과 TinyLock의 안전성에 대하여 비교 분석하였다. 자동화된 스머지 공격에서 높은 공격 성공률을 보였으며 기존에 많이 사용되고 있는 안드로이드 패턴 락이TinyLock보다 더 안전하지 않음을 검증하였다.
Abstract
As smart mobile devices having touchscreens are growingly deployed, a pattern lock system, which is one of the graphical password systems, has become a major authentication mechanism. However, a user's unlocking behaviour leaves smudges on a touchscreen and they are vulnerable to the so-called smudge attacks. Smudges can help an adversary guess a secret pattern correctly. Several advanced pattern lock systems, such as TinyLock, have been developed to resist the smudge attacks. In this paper, we study an automated smudge attack that employs machine learning techniques and its effectiveness in comparison to the human-only smudge attacks. We also compare Android pattern lock and TinyLock schemes in terms of security. Our study shows that the automated smudge attacks are significantly advanced to the human-only attacks with regard to a success ratio, and though the TinyLock system is more secure than the Android pattern lock system.
참고문헌 (17)
- A. De. Angeli, "Is a picture really worth a thousand words? exploring the feasibility of graphical authentication systems", International Journal of Human-Computer Studies, 63(1), pp.128~152 (2005)
- P. Andriotis, "A Pilot Study on the Security of Pattern Screen-Lock Methods and Soft Side Channel Attacks", Proc. of the sixth ACM conference on Security and privacy in wireless and mobile networks(WiSec'13), pp.1~6 (2013)
- P. Andriotis, "POSTER: Breaking the Android Pattern Lock Screen with Neural Networks and Smudge Attacks", Proc. of the sixth ACM conference on Security and privacy in wireless and mobile networks (WiSec'14) (2014)
- A. J. Aviv, "Smudge Attacks on Smartphone Touch Screens", Proc. of the 4th USENIX Conference on Offensive Technologies(WOOT'10), pp.1~7 (2010)
- A. J. Aviv, "Is Bigger Better? Comparing User-Generated Passwords on 3x3 vs. 4x4Grid Sizes for Android's Pattern Unlock", Proc. of the 31st Annual Computer Security Applications Conference(ACSAC' 16), pp.301~310 (2015)
- C. M. Bishop, "Pattern Recognition and Machine Learning" (2006), Springer
- P. E. Danielsson, "Euclidean Distance Mapping", Computer Graphics and image processing, 14(3), pp.227~248 (1980), Elsevier
- B. V. Dasarathy, "Nearest Neighbor (NN)Norms: NN Pattern Classification Techniques" (1991), IEEE Computer Society Press
- D. Davis, "On user choice in graphical password schemes", USENIX Security Symposium (2004)
- H. Gao, "Yagp : Yet another graphical password strategy", Annual Computer Security Applications Conference(ACSAC'08), pp.121~129 (2008)
- I. Jermyn, "The design and analysis of graphical passwords", Proc. of the 8th Conference on USENIX Security Symposium(SSYM’99), pp.1~14 (1999)
- T. Kwon, "TinyLock : Affordable Defense Against Smudge Attacks on Smartphone Pattern Lock Systems", Computers & Security, 42, pp.137~150 (2014), Elsevier
- K. Renaud, "Visual passwords : Cure-all or snake-oil?", Communications of the ACM, 52(12), pp.135~140 (2009)
- S. Schneegass, "Smudgesafe : Geometric Image Transformations for Smudge-Resistant User Authentication", Proc. of the 2014 ACM International Joint Conference on Pervasive and Ubiquitous Computing(UbiComp'14), pp.775~786 (2014)
- Y. Song, "On the effectiveness of pattern lock strength meters : Measuring the strength of real world pattern locks", Proc. of the 33rd Annual ACM Conference on Human Factors in Computing Systems(CHI'15), pp.2343~2352 (2015)
- S. Uellenbeck, "Quantifying the security of graphical passwords : The case of Android unlock patterns", Proc. of the 2013 ACM SIGSAC conference on Computer \& communications security(CCS'13), pp.161~172 (2013)
- E. v. Zezschwitz, "Making Graphic-Based Authentication Secure Against Smudge Attacks", Proc. of the International Conference on Intelligent User Interfaces(IUI'13), pp.277~286 (2013)