Proposal of a Puzzle Authentication Method with Shoulder-surfing Attack Resistance

Recently, mobile terminals such as smartphones have come into widespread use. Most of such mobile terminals store several types of important data, such as personal information. Therefore, in order to prevent data theft, it is necessary to lock and unlock terminals using a personal authentication method such as personal identification numbers (PINs). However, most existing authentication methods have a common problem, referred to as shoulder-surfing in which authentication information is covertly obtained by peeking over the shoulder of a user as he/she completes the authentication sequence. In this paper, we propose a puzzle authentication method that is very simple and sufficiently secure, even when the authentication sequence is being watched. This method uses a grid-based authentication scheme in which a user selects four out of 16 panels, and four out of 16 positions. We also implemented the proposed method on a mobile terminal and evaluated it through experiments and questionnaire surveys.