Towards Device-to-User Authentication: Protecting Against Phishing Hardware by Ensuring Mobile Device Authenticity using Vibration Patterns

TitleTowards Device-to-User Authentication: Protecting Against Phishing Hardware by Ensuring Mobile Device Authenticity using Vibration Patterns
Publication TypeConference Paper
Year of Publication2015
AuthorsFindling, R. Dieter, & Mayrhofer R.
Conference Name14th International Conference on Mobile and Ubiquitous Multimedia (MUM’15)
Date Published12/2015
PublisherACM
Conference LocationLinz, Austria
Keywordsfeedback, mobile authentication, Phishing hardware, vibration
Abstract

Users usually authenticate to mobile devices before using them (e.g\ PIN, password), but devices do not do the same to users. Revealing the authentication secret to a non-authenticated device potentially enables attackers to obtain the secret, by replacing the device with an identical-looking malicious device. The revealed authentication secret could be transmitted to the attackers immediately, who then conveniently authenticate to the real device. Addressing this attack scenario, we analyze different approaches towards mobile device-to-user (D2U) authentication, for which we provide an overview of advantages/drawbacks, potential risks and device authentication data bandwidth estimations. We further analyze vibration as one D2U feedback channel that is unobtrusive and hard to eavesdrop, including a user study to estimate vibration pattern recognition using a setup of  bits per second (b/s). Study findings indicate that users are able to distinguish vibration patterns with median correctness of 97.5% (without taking training effects into account) - which indicates that vibration could act as authentication feedback channel and should be investigated further in future research.

Research Project: