비밀번호 훔쳐보기로부터 안전한 기술을 내장시킨 비밀번호 입력기의 설계 및 구현

Shoulder surfing attacks (SSAs) are a type of observation attack designed to illicitly gather sensitive data from "over the shoulder" of victims. This attack can be directed at mobile devices, desktop screens, Personal Identification Number (PIN) pads at an Automated Teller Machine (ATM), or written text. Existing solutions are generally focused on authentication techniques (e.g., logins) and are limited to specific attack scenarios (e.g., mobile devices or PIN Pads). We present ShotjldAR, a mobile and usable system to detect SSAs using multimodal eye gaze information (i.e., from both the potential attacker and victim). ShouldAR uses an augmented reality headset as a platform to incorporate user eye gaze tracking, rear-facing image collection and eye gaze analysis, and user notification of potential attacks. In a 24-participant study, we show that the prototype is capable of detecting 87.28% of SSAs against both physical and digital targets, a two-fold improvement on the baseline solution using a rear-facing mirror, a widely used solution to the SSA problem. The ShouldAR approach provides an AR-based, active SSA defense that applies to both digital and physical information entry in sensitive environments.

In general, it is difficult to remember a strong password i.e. a long and random password. So, the common tendency of a user is to select a weak alphanumeric password that is easy to remember. But the password which is easy to remember is also easy to predict. In contrast, the password that is very difficult to predict or requires more computation to break is also difficult to remember. To overcome this limitation of creating secure and memorable passwords, researchers have developed graphical password scheme which takes images as passwords rather than alphanumeric characters. But graphical password schemes are vulnerable to shoulder-surfing attack where an attacker can capture a password by direct observation. In this paper a graphical password scheme, namely SG-PASS is proposed which can prevent the shoulder-surfing attack by a human observer and also spyware attack, using a challenge response method.

Authentication based on biometric provides various advantages in ATMs (Automated Teller Machine) systems. The weakness of existing authentication scheme in ATM is the usage of PIN (Personal Identification Number) numbers as password. Because PIN numbers are easily traceable and misused. In order to achieve security and to overcome these illegal activities, our proposed system is developed to provide better security to the ATMs. Here, the PIN numbers are replaced with biometric security. The main objective of the work is to eliminate the use of ATM cards completely and to ensure better security. In this proposal, we provide the idea of using Aadhaar number as user ID and fingerprint as password. After biometric verification, the user will be allowed to proceed with the transaction. In case of three successive wrong attempts, the account will be blocked.

This safety alert aims to raise public awareness regarding increasing incidents of ATM-related crimes, including card skimming, shoulder surfing, and physical theft. Criminals are employing advanced tactics such as hidden cameras, fake keypads, and remote data capture to steal personal banking information and commit fraud. Additionally, physical attacks near ATM machines, especially during nighttime or in poorly lit areas, have also been reported. The alert emphasizes the importance of vigilance while using ATM machines and outlines safety measures such as covering the keypad during PIN entry, avoiding isolated machines, inspecting the ATM for suspicious devices, and being aware of surroundings. Financial institutions are advised to enhance surveillance, improve lighting, and educate customers on secure ATM practices. Proactive measures by both users and institutions are crucial in mitigating risks and ensuring secure banking transactions. The purpose of this project is to enhance the safety and security of Automated Teller Machine (ATM) users by identifying risks, raising awareness, and implementing preventative measures against ATM- related crimes. With the rise in fraudulent activities such as skimming, card trapping, PIN theft, and physical assaults, there is a critical need to educate the public and improve security infrastructure around ATM usage. Keywords: Survelience Camera, ATm Safety, Theif Protection, GPS location alert, Siren alert,

In recent years, Automated Teller Machines (ATMs) are witnessed as the most widely used gadgets which required personal identification numbers (PINs) for authentication along with ATM cards. But PINs are suspected of many threats like a man-in-the-middle attack, spoofing, and eavesdropping, etc., which can affect secure and private information. In this paper, we present a novel secure authentication system for ATMs. In this paper, we replace ATM card with facial expression authentication and makes ATMs intelligent enough to recognize users and give them access to their accounts. Replacement of cards will solve the current problem of skimming data from cards with the use of skimmers.

Shoulder surfing is an easy attack, where an unauthorized user tries to gain access to sensitive information. Unfortunately, none of the currently available content-based shoulder-surfing approaches for protected graphical concealed keywords are both trustworthy and professional. This paper proposes an authentication technique that operates on touchscreen devices with an aim to solve the problem of shoulder-surfing assaults over validation. Graphical passwords are required to get access to the system and to assist with its security. A graphical password is a type of password that can be used instead of a textual password to gain access to a system. It is safer than a written password, which is vulnerable to a shoulder-surfing assault. In this study, we used a falsification technique to create a system that is immune to shoulder-surfing assaults. As a result, the hacker will be perplexed when attempting to obtain and misuse the password. Using Android Studio, the proposed scheme was developed into an android application composed of shoulder-surfing resistant user registration and login process. When compared with other graphical password techniques based on images, the proposed the technique of graphical authentication mechanism with numbers/digits is more easy to memorize and has less cognitive strain on the user. Our graphical authentication technique has more complexity and larger password space than the conventional numeric password schemes, making it a superior method for safeguarding against shoulder surfing attacks. To meet customer expectations, this project seeks to design a graphical password by combining processes such as long key press, and acceleration detection mechanism of Android devices.

Providing security to bank customers is the prime responsibility of banking institutions. These institutions upgrade their services to provide convenience-based banking exposure. Automatic Teller Machines (ATMs) assist the bank's customers to operate independently. ATMs verify the authenticity of the user through a 4-digit personal identification number (PIN) only. The State Bank of India (SBI) has initiated a double security check system to minimize the probabilities of banking frauds through ATMs. SBI customers must provide a one-time password (OTP) along with a PIN to complete the cash withdrawal transaction through the SBI ATM. The objective of the study is to analyze the impact of financial security enhancement in ATMs cash transactions through one-time password on the probabilities of banking frauds through ATMs. The study has used primary data collected through a questionnaire from 422 respondents. The study resulted that one-time password has enhanced the financial security function of ATMs and now the probabilities of ATM frauds has been reduced substantially.

Two-factor authentication techniques using combination of magnetic cards and personal identification numbers (PINs) are widely used in many applications including automatic teller machines and point of sales. Similar to other valuable personal possessions, cards can be easily stolen by pickpockets. Furthermore, recent security reports show that magnetic cards can be easily duplicated using fake card readers and PINs can be obtained by shoulder surfing legitimate users' PIN entry processes. With this combination, criminals can easily break into users' accounts which represents a great threat. In this paper, we propose a new PIN entry scheme which is resistant against shoulder-surfing attacks conducted by shoulder-surfers with normal cognitive capabilities. Additionally, this scheme offers a relatively good level of security when the shoulder-surfer can record the entire login procedure for one or two times with a video device. Mathematical analysis of the proposed scheme is also presented.

An automated teller machine (ATM) is an electronic device that allows customers of a financial institution to access their account and to perform financial transactions such as checking their account balance and withdrawing cash without the need for a bank teller. The customer is issued with a plastic card with a magnetic stripe (or a chip) that contains a card number and security information that uniquely identifies the customer. The customer inserts the card into the machine and enters the personal identification number (PIN), which must match the PIN stored in the card. There are several million ATMs in use around the world.

A shoulder-surfing attack aims to acquire personal data such as passwords and sensitive user credentials. It does not require special technical knowledge, just observation of the user's inputs. The rapid advancement of surveillance technology and covert tools, including closed-circuit cameras, is leading to an increase in shoulder surfing attacks. To resist them, an authentication approach is proposed that combines several defensive techniques, such as an Illusion Personal Identification Number (IPIN), entered via a virtual keypad. The approach employs a hybrid image displaying two keypads, or a hybrid keypad overlaying another designed for direct and indirect lines of sight, seeking the shortest distance at which an attacker is incapable of tracking the inputs. The approach uses an innovative algorithm to shuffle the keypads for each authentication session, as well as a novel keypad pattern exclusive to the IPIN. Even if an attacker remembers the spatial layout of the keypad, they will be unable to trace the IPIN in the next session. To provide more security, the IPIN approach has been added to biometric authentication (fingerprint) and one-time-password (OTP) verification to proposed a new approach to prevent this kind of attack. The proposed approach was tested in terms of usability, clarity, user awareness of an attack, and ease of use of these blended techniques. The suitability of the proposed approach was examined for vital departments within organizations. In addition, the proposed approach was compared with other authentication systems to gauge resilience against certain attacks. The results are promising, although as an authentication approach, continuous enhancements are required, including testing with a larger number of users.

With the increase of automated teller machine (ATM) frauds, new authentication mechanisms are developed to overcome security problems of personal identification numbers (PIN). Those mechanisms are usually judged on speed, security, and memorability in comparison with traditional PIN entry systems. It remains unclear, however, what appropriate values for PIN-based ATM authentication actually are. We conducted a field study and two smaller follow-up studies on real-world ATM use, in order to provide both a better understanding of PIN-based ATM authentication, and on how alternative authentication methods can be compared and evaluated. Our results show that there is a big influence of contextual factors on security and performance in PIN-based ATM use. Such factors include distractions, physical hindrance, trust relationships, and memorability. From these findings, we draw several implications for the design of alternative ATM authentication systems, such as resilience to distraction and social compatibility.

The increasing reliance on Automated Teller Machines (ATMs) has highlighted the urgent need for advanced authentication mechanisms to safeguard user transactions against fraud and unauthorized access. However, traditional methods such as Personal Identification Numbers (PINs) and passwords remain vulnerable to attacks, while unimodal biometric systems face challenges of inter-class variance, environmental interference, and non-universality. Specifically, single-modality approaches and conventional ATM cameras fall short in capturing reliable biometric features under varying conditions, while the effectiveness of bimodal approaches in such environments has not been adequately investigated. Therefore, this study developed a bimodal biometric authentication system integrating face and iris recognition with Gray Level Co-Occurrence Matrix (GLCM) for enhanced ATM security. The system leverages GLCM for powerful texture feature extraction from both modalities, capturing intricate spatial relationships that are difficult to spoof. The extracted feature vectors were used to train Support Vector Machines (SVM) with a Radial Basis Function (RBF) kernel as classifiers for both face and iris recognition. The final authentication decision was made using Boolean OR rule fusion. The system achieved a remarkable accuracy of 98.2%, with a False Acceptance Rate (FAR) of 1.8% and a False Rejection Rate (FRR) of 1.2%. These results demonstrably outperformed comparable unimodal systems and existing biometric ATMs, validating the proposed framework as a highly secure and efficient solution for financial authentication systems.

In these days, smartphones are being widely used, people use them to store sensitive and private information. The password authentication is the most used authentication method, however, the password can be disclosure through shoulder surfing attack, since the users write their password in public places and they tend to make the password easy to remember which increase the vulnerability to attacks. Many authentications schemes were proposed to prevent shoulder surfing attack, but they still vulnerable to shoulder surfing attack or have accuracy problems or lack in usability. In this paper, we proposed a gaze-text based PIN entry method, which we called PathGazePIN. It will utilize the user's eye movement to enter the password. The main idea is allowing the user to authenticate by following numbers that move along fixed paths on the screen by using two authentication interfaces: random interface and sorted interface. The results represented that the proposed system will increase the security against shoulder surfing attack as well as usability and accuracy.

The latest boom in the prevalence of smartphones has been encouraging various personal services to store and utilize important data such as photos and banking information. Thus, the importance of user authentication has also been growing rapidly. Nevertheless, many problems have arisen as a result of the common method of using a four-digit personal identification number (PIN) because of its potential for being breached by a brute force attack or shoulder-surfing attack. Various authentication schemes have been developed to overcome these problems. In this paper, we also propose a new password-based user authentication scheme that utilizes the well-known Minesweeper game, providing better usability as well as greater security. The proposed scheme provides its users a simple method for memorizing their passwords and usable security by allowing them to enter calculated values rather than the password itself.

Users may have various login ids that will be hard to remember their passwords and alphanumeric passwords are difficult to remember. One solution is to use graphical passwords that are more secure. Some threats of Internet security are spyware and shoulder-surfing attacks. This paper presents a new scheme for graphical password that uses images that are unexplainable and have larger password space. The proposed scheme is also resistant to spyware and shoulder-surfing attacks.