As users start carrying multiple mobile devices, we
propose a novel, token based mobile device unlocking
approach. Mobile devices are conjointly shaken to transfer
the authentication state from an unlocked token device to
another device to unlock it. A common use case features a
wrist watch as token device, which remains unlocked as long
as it is strapped to the user’s wrist, and a locked mobile
phone, which is unlocked if both devices are shaken
conjointly. Shaking can be done single-handedly, requires
little user attention (users don’t have to look at the
device for unlocking it) and does not cause additional
cognitive load on users. In case attackers gain control
over the locked phone, forging shaking is difficult, which
impedes malicious unlocks. We evaluate our approach using
acceleration records from our 29 people sized ShakeUnlock
database and discuss influence of its constituent parts on
the system performance. We further present a performance
study using an Android implementation and live data, which
shows the true negative rate of observational attacks to be
in the range of 0.8 – if an attacker manages to gain
control over the locked device and shake it in parallel to
the device owner shaking the token device.
@article{Findling_17_ShakeUnlockSecurelyTransfer, author = {Findling, Rainhard Dieter and Muaaz, Muhammad and Hintze, Daniel and Mayrhofer, Ren\'e}, title = {ShakeUnlock: Securely Transfer Authentication States Between Mobile Devices}, journal = { {IEEE} Transactions on Mobile Computing ({TMC})}, year = {2017}, volume = {16}, number = {4}, pages = {1163--1175}, month = apr, doi = {10.1109/TMC.2016.2582489}, keywords = {Mobile environments, Security and Privacy Protection, Authentication, Time series analysis}, url = {https://ieeexplore.ieee.org/document/7494938/} }