[电商] 【SIGGRAPH Asia 2012专题*新兴技术】光标的伪装：多个虚拟光标作为一个防御肩窥

[复制链接]

铁锹

3D打印店铺

5472 主题	6 听众	1万积分

版主

Rank: 7 Rank: 7 Rank: 7

纳金币: 76544
精华: 23

电梯直达

楼主

发表于 2012-12-5 14:52:00 |只看该作者 |倒序浏览

【SIGGRAPH Asia 2012专题】新兴技术之六：

光标的伪装：多个虚拟光标作为一个防御肩窥

CursorCamouflage: Multiple Dummy Cursors as A Defense against Shoulder Surfing

Keita Watanabe, Fumito Higuchi, Masahiko Inami, Takeo Igarashi

图1。行动光标伪装。

1。介绍

越来越多的服务和信息被存储在云上。由于任何人都可以访问互联网终端，它提供相应的安全机制是至关重要的。一种流行的做法是加强协议和加密算法，这是现在在安全领域正在积极调查。另一种可能有效的方法是提高安全系统的用户界面。由于安全最终是一个人机交互的问题，我们认为后者的方法有很多有趣的机会。

在本文中，我们提供了一个示例应用创新的用户界面的方法，以提高安全性。我们的目标问题域是当一个人输入密码或个人识别码（PIN）使用软件键盘和间接的输入设备如鼠标或触控板，肩窥。这种类型的键序列是容易看见的潜在的攻击者站在背后的用户或通过摄像机观察屏幕。肩窥抵御的方法，显然是重要的。的常规方法之一是改变键分配键盘每次出现在屏幕上，以显示分配只在开始。

但是，这种方法不能正常工作，如果一台摄像机录制屏幕。已经提出了其它几种方法[9，13，15]，但它们都是要么太复杂或要求用户记住密码除了额外信息本身。

我们的方法，称为光标伪装，显示了多个独立的假的光标在屏幕上移动，从而使攻击者很难识别软件的关键用户实际输入（图1）。用户可以识别真正的光标。由观测的手的运动和光标移动之间的相关性，但它是很难这样做的攻击，因为不容易观察到的相关性。这种方法有一个一定的阻力的视频记录，并且不要求用户记住任何额外的信息。
1. Introduction

More and more services and information are being stored on the cloud. Since anybody can access an Internet terminal, it is critical to provide appropriate security mechanisms. One popular approach is to strengthen the protocol and encryption algorithm, which is now being actively investigated in the security field. Another potentially effective approach is to enhance the user interface for security systems. Since security is ultimately a human-computer interaction problem, we believe that there are many interesting opportunities related to the latter approach.

In this paper, we present an example of applying an innovative user interface method to enhance security. Our target problem domain is shoulder surfing when an individual is typing a password or personal identification number (PIN) using a software keyboard and an indirect input device such as a mouse or track pad. Such typed key sequences are readily visible to potential attackers standing behind the user or observing the screen via video camera. A method to defend against shoulder surfing is clearly important. One of the conventional methods is to change the key assignment each time the keyboard appears on the screen and to reveal the assignment only at the beginning.

However, this method does not work if a video camera is recording the screen. Several other methods have been proposed [9, 13, 15], but they are all either too complicated or require the user to memorize extra information in addition to the password

itself.

Our method, called Cursor Camouflage, shows multiple independently moving dummy cursors on the screen so as to make it difficult for an attacker to identify which software key the user is actually typing (Figure 1). The user can identify the real cursor

by observing the correlation between the hand motion and the cursor motion, but it is difficult for an attacker to do so because the correlation is not easy to observe. This method has a certain resistance to video recording and does not require the user to

memorize any additional information.

更多“光标的伪装：多个虚拟光标作为一个防御肩窥”内容请下载附件文本和视频进行了解，更多分享尽在web3D纳金网http://www.narkii.com/