We are witnessing a growing demand for ATM authentication solutions that overcome the limitations of the de facto standard mechanism based on magnetic card and numeric PIN, that has revealed to be weak against ATM-specific attacks (e.g., skimming and recording attacks). An emerging trend is relying on smartphones as a carrier for authentication. However, authentication mechanisms based on the use of a smartphone requires the same mechanisms to be resilient to new, smartphone-specific threats like device theft and common attacks like shoulder-surfing attacks and spyware. In this paper, we propose a new ATM authentication mechanism called Color Wheel Pin which combines a usable ATM authentication mechanism with robustness against both generic and smartphone and ATM specific security threats.
A.Armando, A.Merlo, M.Migliardi and L.Verderame, Breaking and fixing the android launching flow, Computers and Security39(Part A) (2013), 104–115.
2.
A.J.Aviv, K.Gibson, E.Mossop, M.Blaze and J.M.Smith, Smudge attacks on smartphone touch screens, in: Proceedings of the 4th USENIX Conference on Offensive Technologies, WOOT’10, USENIX Association, Berkeley, CA, USA, 2010, pp. 1–7.
3.
A.Bianchi, I.Oakley and D.-S.Kwon, Open sesame: Design guidelines for invisible passwords, Computer45(4) (2012), 58–65.
4.
A.Bianchi, I.Oakley and D.S.Kwon, The secure haptic keypad: A tactile password system, in: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI ’10, ACM, New York, NY, USA, 2010, pp. 1089–1092.
5.
A.Bianchi, I.Oakley and D.S.Kwon, Spinlock: A single-cue haptic and audio PIN input technique for authentication, in: Proceedings of the Haptic and Audio Interaction Design: 6th International Workshop, HAID 2011, Kusatsu, Japan, August 25–26, 2011, Springer, Berlin, Heidelberg, 2011, pp. 81–90.
6.
A.Bianchi, I.Oakley, J.K.Lee and D.S.Kwon, The haptic wheel: Design & evaluation of a tactile password system, in: CHI ’10 Extended Abstracts on Human Factors in Computing Systems, CHI EA ’10, ACM, New York, NY, USA, 2010, pp. 3625–3630.
7.
L.Caviglione, M.Coccoli and A.Merlo, A taxonomy-based model of security and privacy in online social networks, International Journal of Computational Science and Engineering9(4) (2014), 325–338.
8.
M.Curti, A.Merlo, M.Migliardi and S.Schiappacasse, Towards energy-aware intrusion detection systems on mobile devices, in: International Conference on High Performance Computing and Simulation (HPCS), July 2013, 2013, pp. 289–296.
9.
A.De Luca, Designing usable and secure authentication mechanisms for public spaces, PhD thesis, Ludwig Maximilians University Munich, 2011, http://dnb.info/1015048234.
10.
A.De Luca, M.Denzel and H.Hussmann, Look into my eyes!: Can you guess my password? in: Proceedings of the 5th Symposium on Usable Privacy and Security, SOUPS ’09, ACM, New York, NY, USA, 2009, pp. 7:1–7:12.
11.
A.De Luca, K.Hertzschuch and H.Hussmann, Colorpin: Securing pin entry through indirect input, in: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI ’10, ACM, New York, NY, USA, 2010, pp. 1103–1106.
12.
A.De Luca, E.von Zezschwitz and H.Hussmann, Vibrapass: Secure authentication based on shared lies, in: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI ’09, ACM, New York, NY, USA, 2009, pp. 913–916.
13.
N.Gobbo, A.Merlo and M.Migliardi, A denial of service attack to GSM networks via attach procedure, in: Proceedings of the Security Engineering and Intelligence Informatics: CD-ARES 2013 Workshops: MoCrySEn and SeCIHD, Regensburg, Germany, September 2–6, 2013, Springer, Berlin, Heidelberg, 2013, pp. 361–376.
14.
M.Guerar, M.Migliardi, A.Merlo, M.Benmohammed and B.Messabih, A completely automatic public physical test to tell computers and humans apart: A way to enhance authentication schemes in mobile devices, in: International Conference on High Performance Computing Simulation (HPCS), July 2015, 2015, pp. 203–210.
15.
R.Khan, R.Hasan and J.Xu, Sepia: Secure-pin-authentication-as-a-service for atm using mobile and wearable devices, in: 3rd IEEE International Conference on Mobile Cloud Computing, Services, and Engineering (MobileCloud), 2015, 2015, pp. 41–50.
16.
M.Kumar, T.Garfinkel, D.Boneh and T.Winograd, Reducing shoulder-surfing by using gaze-based password entry, in: Proceedings of the 3rd Symposium on Usable Privacy and Security, SOUPS ’07, ACM, New York, NY, USA, 2007, pp. 13–19.
17.
T.Kwon, S.Shin and S.Na, Covert attentional shoulder surfing: Human adversaries are more powerful than expected, Systems, IEEE Transactions on Systems, Man, and Cybernetics44(6) (2014), 716–727.
18.
M.-K.Lee and H.Nam, Secure and usable PIN-entry method with shoulder-surfing resistance, in: HCI International 2013 – Posters’ Extended Abstracts: Proceedings of the International Conference, HCI International 2013, Part II, Las Vegas, NV, USA, July 21–26, 2013, Springer, Berlin, Heidelberg, 2013, pp. 745–748.
19.
A.Merlo, M.Migliardi and L.Caviglione, A survey on energy-aware security mechanisms, Pervasive and Mobile Computing24 (2015), 77–90.
20.
A.Merlo, M.Migliardi and P.Fontanelli, On energy-based profiling of malware in android, in: International Conference on High Performance Computing Simulation (HPCS), July 2014, 2014, pp. 535–542.
21.
A.Merlo, M.Migliardi and P.Fontanelli, Measuring and estimating power consumption in android to support energy-based intrusion detection, Journal of Computer Security23(5) (2015), 611–637.
22.
A.Merlo, M.Migliardi, N.Gobbo, F.Palmieri and A.Castiglione, A denial of service attack to umts networks using sim-less devices, IEEE Transactions on Dependable and Secure Computing11(3) (2014), 280–291.
23.
D.Nyang, A.Mohaisen and J.Kang, Keylogging-resistant visual authentication protocols, IEEE Transactions on Mobile Computing13(11) (2014), 2566–2579.
24.
T.Perković, S.Li, A.Mumtaz, S.A.Khayam, Y.Javed and M.Čagalj, Breaking undercover: Exploiting design flaws and nonuniform human behavior, in: Proceedings of the Seventh Symposium on Usable Privacy and Security, SOUPS ’11, ACM, New York, NY, USA, 2011, pp. 5:1–5:15.
25.
M.Raza, M.Iqbal, M.Sharif and W.Haider, A survey of password attacks and comparative analysis on methods for secure authentication, World Applied Sciences Journal19(4) (2012), 439–444.
26.
V.Roth, K.Richter and R.Freidinger, A pin-entry method resilient against shoulder surfing, in: Proceedings of the 11th ACM Conference on Computer and Communications Security, CCS ’04, ACM, New York, NY, USA, 2004, pp. 236–245.
27.
H.Sasamoto, N.Christin and E.Hayashi, Undercover: Authentication usable in front of prying eyes, in: Proceedings of the SIGCHI Conference on Human Factors in Computing Systems, CHI ’08, ACM, New York, NY, USA, 2008, pp. 183–192.
28.
D.S.Tan, P.Keyani and M.Czerwinski, Spy-resistant keyboard: More secure password entry on public touch screen displays, in: Proceedings of the 17th Australia Conference on Computer–Human Interaction: Citizens Online: Considerations for Today and the Future, ACM Press, 2005, pp. 1–10.
