A rotary PIN entry scheme resilient to shoulder-surfing

Abstract

The combination of tokens or cards and personal identification numbers (PINs) are widely used for authentication in many applications including automatic teller machines (ATMs) and point of sales (POSs). Recent security incidents have shown that criminals can get these authentication tokens or cards either by pickpocketing or through fake magnetic card readers. Furthermore, PINs may also be captured through shoulder-surfing or by the use of concealed miniature cameras. Upon obtaining both authentication factors, criminals can easily break into users' accounts which presents a high security risk. In this paper, we propose a new spinwheel-like PIN entry scheme which is resilient against shoulder-surfing attacks even if the shoulder-surfer can record the entire PIN entry procedure for one time with a video device. This scheme has two variants, both of which achieve a good balance between security and usability.