Welcome to the presentation of 3D-Auth
two-factor authentication with
personalized 3d printed items.
I'm Karola Marky from the Telecooperation Lab
at Technische Universität Darmstadt in Germany and let's start.
I would like to start
with a brief introduction into
two-factor authentication.
Let's consider a user who is at home and the
user wants to connect to a digital service.
They start by entering their user
ID and a password which in most of the
cases is the first authentication factor
in two-factor authentication. But why do
we need two factors in the first place?
Passwords have several weaknesses from a
security point of view. For instance, the
password might get phished, there might be
a virus on the users computer or
the password database of a service might
get hacked and lead or the password
might get stolen on the way and from a
security point of view adding a
second factor enhances the situation
because if the passwords get stolen
the attacker also needs to get a second
factor in order to impersonate the user.
So how does such a second factor look like?
It could be a biometric
feature of the user such as the user's
fingerprint, it could be some other
biometrical data or it could be
something that the user ownes and this
could also be like a one-time password.
For instance, this can be generated by
one-time password generators, there are
also possibilities to use credit cards
or other banking cards as the second
factor in online banking or a one-time
password might be generated by an
application on a smartphone and in the
remainder here I would like to talk
about this physical representation of a second factor.
While in general the
physical representations work that means
the second factor here's usable people
can successfully login to their online
banking and authorize
transactions there are still some
weaknesses that are present in these
physical representations. The first one
is that it lacks customization that
means if a user now wants to use a
specific mechanism they have to use it
in the representation that is given by
the provider.
For instance, the one-time password
generator on the lower left just looks
this way but it might be that the user
wants to have like a more personalized
shape such as the shape of their
favorite animal or whatever.
The second issue is connected to the usage of the
factor and by saying here "I can't use it"
I don't mean usability I mean that the
second factor is not available might be
that people have it at home or that the
second factor is reliant on an energy
source, such as batteries or a mobile
network, and batteries can
run out or the mobile network might not
be available and because of that the
user cannot authenticate successfully.
And with this in mind I would like to
introduce the concept of 3D-Auth to you
please also consider that when we made
3D-Auth we didn't want to improve
an existing physical representation we just
wanted to start new from scratch.
Also we wanted to try to address some
weaknesses of the password. So how does
3D-Auth work? 3D-Auth is
based on personal 3D printed items.
Here you can see a simplified example in the
form of a combination lock. The red
material is an insulating material this
could be any plastic and the black
material is conductive that means it can
be sensed by a commercial touchscreen
and because of that you don't need any
additional energy sources but of course
we are limited to devices with
touchscreens
so let me explain to you how
authentication with a 3D-Auth item
works first of all it is based on a
secret that is encoded in the item's
internal structure. Here you can see this
little dot on the top which is the top
of the secret basically. This represents
the factor of ownership the second
factor is added by interacting with the
device that means the user has to know
how to interact the device and both
together activate touch points in the
bottom of the 3D-Auth item and
those touch points form an
authentication pattern. So let me show
you how that works: in the video here you
see the simplication
of the inner of a 3D-Auth item
in the middle do you see the secret and
interacting with the item changes its
configuration now we have two touch
points that can be sensed by the
touchscreen once the user touches the
conductive structure but of course this
is highly simplified and a real 3D-Auth
item has a way more complex internal
structure now to generate possible
interactions that the users can use to
authenticate we conducted expert design
studies with a total of 19 experts from
the areas human-computer interaction,
security, psychology, and design.
We presented different views, different usage contexts
and settings to them and finally our
study resulted in five categories of
possible authentication interactions
that I will explain on the next slides.
The first possible category of
interaction is called "touch" in this
category the user touches this 3D-Auth
item in a predefined spot as
you can see we've also developed a
prototype for the touch item and here
you can see four possible spots where
the user can touch the item and the
authentication pattern is a subset of
them considering "arrangement" that means
that the user has a 3D-Auth item on
the display of the device and arranges
it somehow for this category we built a
prototype of a slider with 10 possible
positions. For the "assembly" category we
build Lego-like building blocks that
means we have a set of different items
and we have to assemble them together to
a final 3D-Auth item. For "configuration"
that means that we change the
configuration basically of the item by
turning it, rotating it, pressing parts of
it, we build a combination lock that you
have just seen earlier and finally we
consider the category of "augmentation"
but we will add water or air to change
the item's configuration and develop
a water tank in which you can
add different amounts of water with a
syringe as you can see all our items
have an identical color and we tried
that they have similar dimensions
and also a similar shape and here you
have a little video of the interaction
with the items. To evaluate our items we
did a user study of with 25 participants
they were on average 36.6
years old eight of them identified as
female, 15 identified as male, one person
preferred not to say, and one identified
as other. During our study, we captured
the following data at first of all we
assessed usability in terms of
effectiveness and efficiency that means
we captured whether the participants in
our user study were actually able to
successfully authenticate and if they
were how long did it take. Then, we also
gathered some feedback with the
user experience questionnaire in its six
scales, after a retention of ten days we
invited the participants to our lab
again to check if they still can
authenticate successfully and also to
measure how memorable the interactions
are and finally we also collected
additional feedback in terms of adoption
and the preferences of the participants
and also some scopes on where the
participants would like to use the items.
The procedure of our user study was
as follows at first of all we welcomed
the participants to our lab and we asked
them to provide demographics. Then, we
explained the user study material to
them basically that consisted of five
different intent cards and each card had
a description on how to authenticate
with the 3D-Auth item we did this to
have a standardized possibility to
communicate this with the participants.
Then, the participants interacted with
all of the 3D-Auth items that means the
study was within-subjects and
the order of the
conditions was randomized by
a Latin Square in order to mitigate
sequence effects. Once the participant had
completed the interaction with all items
we gave them a final questionnaire and
proceeded with the debrief.
Now, let me present the results of our study.
At first of all in terms of effectiveness
and efficiency.
Considering the touch item 92% of our
participants were able to correctly
interact with it instantly and the took
on average 17 seconds the main reason
for not interacting with it correctly
was basically placing it upside down.
Considering the slider which represents
our arrangement category 68% of
participants were able to interact with
it correctly and needed on average 27
seconds the main reason for not
interacting with it correctly was
placing the slider upside down. We don't
consider this to be problematic because
you could actually print an
additional line such that the smartphone can
recognize the orientation of an item and
then it's no longer problematic.
84% of participants
correctly interacted with the building
plots and I needed 54 seconds with it which
also is longest this is due to the
fact that the participants first had to
figure out how to connect the items
together considering our configuration
log 68% interact with it
correctly and needed about 43
seconds to do so the main reason for
not interacting with it
correctly was actually as you have seen
earlier in the video in the end it is
needed to touch the two dots on top and
some participants simply only touched
one dot. Finally, considering the water
tank 88% of participants interacted with
it correctly and on average needed 47
seconds. After a retention of ten days we
invited the participants again and the
memorability of 3D-Auth items was
generally always over 90% which is
pretty good. Now, that we have spoken
about the usability of 3D-Auth let me
talk a little bit about the security in
terms of the password space. The password
space is all possible combinations how
we configure a 3D-Auth item and our
prototype here they are limited in
terms of that because we actually
focused on the usability and that is
actually a prototype that is working
instead of providing something with a
wizard of oz study. So how many possible
combinations does the touch item have?
The touch item has these four dots and they
can be touched in 15 different
possibilities, the slider has ten
positions to slide thus the password space is
also 10, the building blocks can be put
together in 26 different positions and
also considering the rotation of the
item, the combination log has by far the
largest password space with 1000
possible combinations. Each layer has 10
possible positions and there are three
layers.
Finally,
the water tank has the
smallest with only three possible
combinations since we can recognize
three different amounts of water and as
you can see this is not practical from a
security point of view because I mean
the water tank it won't take really
long to perform a brute-force attack on
that so now I would like to show you how
we aim to secure 3D-Auth items and it
is also lengthly discussed in the paper
and therefore we revisit the
authentication pattern. We consider the
authentication pattern to be a set of
dots in the bottom of the 3D-Auth
item it doesn't have to be uniform it
could be any kind of distribution. Those
dots are turned into touch points at
first by the encoded secret, then
depending on the interaction a second
subset of touch points I mean a second subset
of conductive dots is turned into touch
points and those two together from the
authentication pattern. In the paper,
based on that we have calculated
the password space of entire 3D-Auth
so like the complete password
space considering that we have access to
raw data and that 3D printing will be
more sophisticated in the future and we
calculated over 33 million possible
combinations as you can see this is a way
better security than our prototype items
I would like to conclude the talk with
showing you a little bit more
sophisticated items that we think I mean
we think 3D-Auth will look like this
in the future.
First of all, you can have like tiny
little items that you carry around with
you, it could be also some decorative
material like this little guitar that
you can put your water in or you could
print the
shape of your favorite animal such as
this little cat as an 3D-Auth
item or it could even be as tiny as a
keychain that you can carry around with
you and you cannot see that it is an
authentication item. The items can be
distributed among different people and
enable group authentication by that.
So, let me conclude 3D-Auth is a stepping stone
for customizable authentication, our
study demonstrates its usability and the
memorability of authentication
interactions and we consider more
sophisticated items as a next step.
If you have any questions feel free to
write me an email or reach out to me on
social media and now I would also like
to show you the other talks from the
Telecooperation Lab at CHI 2020. Bye.