Hello, I’m Shuning Zhang and I would introduce
Squeez’In: Private authentication on smartphones based on squeezing gestures.
As you all know, authentication on mobile devices could be divided into
two categories: code based authentication technique and
biometric features based authentication technique.
They were widely spread and accepted.
However, code based ones such as pin code and graphical gestures
are prone to shoulder surfing and is difficult to memorize;00:27
hile although others like fingerprint and faceID
would have a high security,
they suffer from privacy concerns,
and the unchangeable biometric information would
also pose risk when copied.
In the past, there were works exploring the two common ways
of authentication techniques, namely the
code based authentication technique and biometric features
based authentication technique, and with increasing concerns
on privacy, more researchers used implicit interaction to do authentication,
where mobile devices track the behaviour of users to judge.
There were works focusing on smartphones and gripping posture,
however, owing to a limited feature space and algorithm design,
they suffer from a low accuracy.
In comparison, we utilized the advantages of squeezing gestures.
Firstly, squeezing gestures with multiple dimensions are
more expressive and secondly, behavioral features during squeezing
are dynamic and specific to users, and lastly squeezing gestures are subtle
and hard to be snooped.
To recap, we made the following contributions:
we systematically explored features of user-defined squeezing gestures
for authentication, and proposed features for designing natural and robust
squeezing gestures. Besides, we designed and implemented squeezIn with
SVM and GBDT model. The algorithm were only based on 3 samples from the user.
Lastly, we validated the authentication performance,
long term stability and usability thoroughly.
To take the first step, we explored the design space of squeezing gestures.
15 participants including 7 male and 8 female were recruited,
the age of whom was around 21.5, with standard deviation 1.1.
A Huawei mate 30 pro smartphone was adopted as the apparatus with
size 158 × 73mm and resolution 2400 × 1176,
the operation system was Android 10.0.
We selected seven main features to inspire participants’ design.
The participants were asked to design an unlocking pattern that they
would like to use in the real world for three different scenarios.
We collected their results and analyzed the feature usage and found
most participants prefer two levels of pressure and duration.
There were some typical examples proposed by participants.
We further analyzed the theoretical code space with the features
and values proposed before. With code length coming from 2 to 5,
touch pressure from 2 to 3, number of fingers from 2 to 5,
we could arrive at a maximum of 3.82 times 10 to the 7th order in total,
which is comparable with 6-digit PIN code and 9-dot gesture.
while even if we only considered the features we finally selected explicitly,
we could arrive at 1.07 times 10 to the 4th order in total,
which is applicable.
Then in study 2, we recruited 14 participants with 6 male and 8 female,
an age around 20.2 and standard deviation 0.9.
We designed two levels and three levels sequence
in terms of touching pressure and duration in order to
explore the control ability of users.
Participants should complete two sessions of touch duration tasks
and two sessions of touch pressure tasks.
In each task, they should squeeze twice, with 2 or 3
levels of pressure or duration in random order.
For touch pressure and specifically for two level gestures,
RM-ANOVA found both intended touch pressure and visual feedback
yielded a significant effect on exhibited touch pressure.
However, no interaction was found. For three-level gestures,
RM-ANOVA found distinguishing three levels of pressure
was only applicable with visual feedback,
and intended pressure were found to significantly affect touch pressure.
While for touch duration and specifically for two-level gestures,
the exhibited touch duration increased with intended touch duration
and RM-ANOVA found touch pressure and intended touch duration
yield significant effect on exhibited touch duration,
with no significant interaction effect.
Whereas for three level gestures,
RM-ANOVA found a main effect of intended touch duration on measured value.
Touch pressure was found to significantly affect touch duration
but no consistent trend found. We concluded that 2 levels of
touch duration were more robust.
Implementation wise, because most smartphones were capacitance based.
We first conduct a measurement to infer pressure from capacitance.
From 14 participants’ squeezing data,
we performed linear fitting between capacitance value and touch pressure
for individual participants and the correlation was not strong.
We further hypothesized from the shape of the datapoints and
do exponential fitting, which fitted all people with a higher R square.
From the users’ perspective, squeezIn’s implementation could be
divided into registration and authentication.
During registration, the user should squeeze the screen for three times
in order to record his unlocking pattern robustly. While during authentication,
the user should just squeeze the code for one time and unlock.
We preprocessed the gesture samples, augmented the data and
reduced feature dimensions to a proper value,
then we ensembled GBDT and SVM to train on registration samples.
While during authentication, the same model and preprocess technique
would be used to judge whether to accept.
To test the feasibility of SqueezIn, we further recruited 21
right handed participants from campus with no overlap with previous studies
Each participant was randomly assigned 1 gesture from the below list
of 21 gestures with no repetition. They should first become familiarize
the apparatus and then perform gestures on the apparatus,
resulting in a total of 168 gestures.
We cross validated and got average authentication accuracy 99.3%.
Besides, we tested the effect of sample size on recognition accuracy
and found 3 samples an applicable sample number.
We also tested the condition when the code collides coincidentally.
The detection accuracy on average remain over 93% with code length 5-7
and FRR were lower than 4.5%.
In order to systematically evaluate the feasibility of SqueezIn
and test the stability over a long time, we further conducted a
long term study with 24 participants. We adopted a one factor
within subject design, with technique as the only factor.
Participants should register on the first day and
come back to write down the code as well as authenticate on the following days.
We adopted one way anova on error rate and two way anova on the memorability.
Time has no significant influence on the accuracy while for memorability,
although techniques as a factor have no significance on error rate,
time poses a significance.
Finally, to evaluate the usability, we conducted the evaluation study
along with other commercial techniques: Gesture, PIN Code, Fingerprint
and Face ID. The same smartphone was adopted, the participants should firstly
become familiarize with the devices and then test the five techniques
in a row, each with three scenarios: in pocket, at hand and on table.
With 18 participants, we collected 90 registration and 270 authentication
data points. In terms of registration, SqueezIn was 29% faster than faceID
and 81% faster than fingerprint. When splitting authentication time into
preparation time and input time, SqueezIn’s input was slower,
however the total authentication time was shorter, which means
the preparation time was significantly shortened.
SqueezIn also achieved a satisfying accuracy compared with other techniques
and subjective ratings in the aspect of security, privacy, social acceptance,
generalizability and memorability, showing the great potential.
Thus, to summarize, we proposed a technique leverage squeezing gestures
to support subtle authentication on smartphones. To achieve this,
we first analyzed the user-defined squeezing gestures to elicit common features.
Then we tested users’ motion control ability during squeezing of
touch pressure and duration. Implementation wise, we built a system
and test on capacitive sensing smartphones. Finally, we evaluated
SqueezIn’s usability in comparison with 4 mainstream authentication techniques.
In the future, there were also explorations worthy of trying.
First, we only leveraged two feature dimensions, however more
exploration space of interaction was attractive. Second,
we implemented on curved screen smartphones but it could be
generalized and tested on other kinds of smartphones.
Third, more in the wild studies instead of lab-based studies
should be conducted in the future.
That’s all of the presentation content, and thanks again
for your kindly listening.