SPOSS: Secure Pin-Based-Authentication Obviating Shoulder Surfing

Classical PIN based authentication schemes are susceptible to shoulder surfing attacks and hence attacker may obtain secret credentials of legitimate user very easily. Some of the existing schemes that provide resistance against shoulder surfing attacks either require multiple rounds for entering single digit or some have dependency on external hardware or some of the schemes require complex computation to be done mentally in order to enter the PIN. Another possible security threat could be stealing the credentials if password file is compromised. In this paper, we propose a new PIN entry mechanism known as SPOSS which provides resilience against not only human-based shoulder surfing but also against recording attack (for one session) in which attacker may impose a recording device like camera to record the whole login session for future reference. SPOSS also provides security against password file compromise attack. Additionally, user authentication can be ensured by single round only without doing any complex computation and without any dependency of external hardware. Experimental analysis shows that proposed scheme achieves a good balance between usability and security parameters.