Passwords are still used on a daily basis for all kind of applications. However, they are not secure enough by themselves in many cases. This work enhances password scenarios through two-factor authentication asking the users to draw each character of the password instead of typing them as usual. The main contributions of this study are as follows: i) We present the novel MobileTouchDB public database, acquired in an unsupervised mobile scenario with no restrictions in terms of position, posture, and devices. This database contains more than 64K on-line character samples performed by 217 users, with 94 different smartphone models, and up to 6 acquisition sessions. ii) We perform a complete analysis of the proposed approach considering both traditional authentication systems such as Dynamic Time Warping (DTW) and novel approaches based on Recurrent Neural Networks (RNNs). In addition, we present a novel approach named Time-Aligned Recurrent Neural Networks (TA-RNNs). This approach combines the potential of DTW and RNNs to train more robust systems against attacks. A complete analysis of the proposed approach is carried out using both MobileTouchDB and e-BioDigitDB databases. Our proposed TA-RNN system outperforms the state of the art, achieving a final 2.38% Equal Error Rate, using just a 4-digit password and one training sample per character. These results encourage the deployment of our proposed approach in comparison with traditional typed-based password systems where the attack would have 100% success rate under the same impostor scenario.

中文翻译：

---

BioTouchPass2：使用时间对齐循环神经网络的触摸屏密码生物识别技术


密码仍然每天用于各种应用程序。然而，在许多情况下，它们本身并不够安全。这项工作通过双因素身份验证增强了密码场景，要求用户绘制密码的每个字符，而不是像往常一样键入它们。这项研究的主要贡献如下：i）我们提出了新颖的 MobileTouchDB 公共数据库，该数据库是在无监督的移动场景中获得的，不受位置、姿势和设备的限制。该数据库包含 217 个用户使用 94 种不同的智能手机型号执行的超过 64K 个在线角色样本，以及最多 6 个采集会话。 ii）我们对所提出的方法进行了完整的分析，考虑了动态时间规整（DTW）等传统身份验证系统和基于循环神经网络（RNN）的新颖方法。此外，我们提出了一种名为时间对齐循环神经网络（TA-RNN）的新颖方法。这种方法结合了 DTW 和 RNN 的潜力，可以训练更强大的系统来抵御攻击。使用 MobileTouchDB 和 e-BioDigitDB 数据库对所提出的方法进行了完整分析。我们提出的 TA-RNN 系统优于现有技术，仅使用 4 位密码和每个字符一个训练样本，最终实现了 2.38% 的等错误率。与传统的基于类型的密码系统相比，这些结果鼓励部署我们提出的方法，在相同的冒充者场景下，攻击将具有 100% 的成功率。