Reducing the effectiveness of smudge and thermal imaging attacks

Patent metadata

Field	Value
Publication number	US-9515831-B2
Application number	US-201414514401-A
Country	US
Kind code	B2
Filing date	Oct 15, 2014
Priority date	Oct 15, 2014
Publication date	Dec 6, 2016
Grant date	Dec 6, 2016

Abstract

An example method is provided for an electronic device, which may have a display and an input interface, to perform password authentication. The example method may include generating at least one sequence of input elements for entry during the authentication of the user's password to disguise entry of the user's password via the input interface by increasing the user's contact with the input interface and prompting, on the display, for an entry of the user's password and the at least one sequence of input elements via the input interface. The example method may further include receiving, via the input interface, entry of the user's password and the at least one sequence of input elements and determining whether the authentication is successful by checking whether the received entry is correct.

First claim

We claim:

1. A method for an electronic device with a display and an input interface to perform password authentication, wherein the input interface includes a set of keys that are contactable during entry of a user's password for authentication, the method comprising:
generating, by the electronic device, multiple sequences of input elements that include a prefix sequence and a postfix sequence for entry during the authentication, wherein the prefix sequence is generated to require contact with a first subset of keys from the set, the postfix sequence is generated based on the postfix sequence to require contact with a second subset of keys from the set, and the second subset is different to the first subset to disguise entry of the user's password via the input interface by increasing contact with the set of keys;
prompting, by the electronic device on the display, for an entry of the prefix sequence, user's password and postfix sequence via the input interface, wherein entry of the user's password is prompted after entry of the prefix sequence and before entry of the postfix sequence;
receiving, by the electronic device via the input interface, entry of the prefix sequence, the user's password and the postfix sequence; and
determining, by the electronic device, whether the authentication is successful by checking whether the received entry is correct.

2. The method of claim 1 , wherein generating the multiple sequences and prompting for the entry comprise:
before the entry of the user's password is prompted, generating, by the electronic device, the prefix sequence and prompting, on the display, for the entry of the prefix sequence; and
after the entry of the prefix sequence and user's password is prompted, generating, by the electronic device, the postfix sequence and prompting, on the display, for the entry of the postfix sequence.

3. The method of claim 1 , wherein generating the postfix sequence comprises:
generating, by the electronic device, the postfix sequence based on, at least in part, the user's password.

4. The method of claim 3 , wherein generating the postfix sequence based on the user's password comprises:
determining, by the electronic device, a third subset of keys from the set of keys of the input interface that are used for the entry of the user's password; and
the electronic device generating the postfix sequence that requires contact with the second subset, wherein the second subset is different to the first subset and third subset.

5. The method of claim 1 , wherein generating the prefix sequence comprises: generating, by the electronic device, the prefix sequence based on, at least in part, the user's password.

6. The method of claim 1 , wherein generating the prefix sequence comprises: generating, by the electronic device, the prefix sequence randomly using a random sequence generator.

7. The method of claim 1 , wherein generating the multiple sequences comprises:
prior to performing the password authentication, tracking, by the electronic device, usage of keys of the input interface; and
based on the tracked usage, generating, by the electronic device, the prefix sequence or postfix sequence to exclude at least one key that is most frequently used, or to include at least one key that is not used or least frequently used.

8. The method of claim 1 , wherein generating the multiple sequences is based on a user configuration relating to one or more of the following:
length of the at least one of the multiple sequences;
complexity of the at least one of the multiple sequences;
whether to generate a prefix sequence, a postfix sequence, or both;
whether to track usage of the input interface to generate the multiple sequences;
whether to generate the prefix sequence based on the user's password; and
whether to generate the postfix sequence based on the prefix sequence or user's password, or both.

9. A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of an electronic device, causes the processor to perform a method for password authentication, wherein an input interface of the electronic device includes a set of keys that are contactable during entry of a user's password for authentication the method comprising:
generating, by the processor, multiple sequences of input elements that include a prefix sequence and a postfix sequence for entry during the authentication, wherein the prefix sequence is generated to require contact with a first subset of keys from the set, the postfix sequence is generated based on the postfix sequence to require contact with a second subset of keys from the set, and the second subset is different to the first subset to disguise entry of the user's password via the input interface by increasing contact with the set of keys;
prompting, by the processor on a display of the electronic device, for an entry of the user's password and the multiple sequences via the input interface, wherein entry of the user's password is prompted after entry of the prefix sequence but before entry of the postfix sequence;
receiving, by the processor via the input interface, entry of the user's password and the multiple sequences; and
determining, by the processor, whether the authentication is successful by checking whether the received entry is correct.

10. The non-transitory computer-readable storage medium of claim 9 , wherein generating the multiple sequences and prompting for the entry comprise:
before the entry of the user's password is prompted, generating, by the processor, the prefix sequence and prompting, by the processor on the display, for the entry of the prefix sequence; and
after the entry of the prefix sequence and user's password is prompted, generating, by the processor, the postfix sequence and prompting, by the processor on the display, for the entry of the postfix sequence.

11. The non-transitory computer-readable storage medium of claim 9 , wherein generating the postfix sequence comprises:
generating, by the processor, the postfix sequence based on, at least in part, the user's password.

12. The non-transitory computer-readable storage medium of claim 11 , wherein generating the postfix sequence based on the prefix sequence or user's password comprises:
determining, by the processor, a third subset of keys from the set of keys of the input interface that are used for the entry of the user's password; and
generating, by the processor, the postfix sequence that requires contact with the second subset, wherein the second subset is different to the first subset and third subset.

13. The non-transitory computer-readable storage medium of claim 9 , wherein generating, by the processor, the prefix sequence comprises: generating the prefix sequence based on, at least in part, the user's password.

14. The non-transitory computer-readable storage medium of claim 9 , wherein generating, by the processor, the prefix sequence comprises: generating the prefix sequence using a random sequence generator.

15. The non-transitory computer-readable storage medium of claim 9 , wherein generating the multiple sequences is based on a user configuration relating to one or more of the following:
length of the at least one of the multiple sequences;
complexity of the at least one of the multiple sequences;
whether to generate a prefix sequence, a postfix sequence, or both;
whether to track usage of the input interface to generate the multiple sequences;
whether to generate the prefix sequence based on the user's password; and
whether to generate the postfix sequence based o

Assignees

• Vmware Inc

Inventors

• Lu Kecheng
• Ouyang Jian
• Kiryakoza James

Classifications

• G06F21/31

  User authentication · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L9/3226 Primary

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title