Abstract Although conventional PIN-entry methods are widely used in many daily authentication procedures, they are highly susceptible to shoulder-surfing attacks. A plethora of PIN-entry methods have been proposed in the literature to mitigate such attacks. Unfortunately, none of these methods is capable of replacing the conventional PIN-entry method. This study presents the results of a systematic review of PIN-entry methods resistant to shoulder-surfing attacks so that the main challenges that impede their adoption can be provided along with opportunities for future research. A systematic search was conducted on seven databases using predefined criteria. A test–retest approach was performed by a single author to extract data. A total of 55 articles were included in this review. The review results manifest that PIN-entry methods are classified mainly into direct and indirect inputs. The user study was the standard research method, and error rate and PIN-entry time were the most frequently adopted usability measures. The review argues that a recording-based shoulder-surfing attack is a major threat to PIN-entry methods. Error rate and PIN-entry time are widely adopted criteria for usability. The review indicates that most PIN-entry methods require a high error rate and PIN-entry time than the conventional method. Moreover, the lack of a standard evaluation framework should be addressed.

中文翻译：

---

系统回顾 PIN 输入方法抵抗肩冲浪攻击

摘要 虽然传统的 PIN 输入方法广泛应用于许多日常认证过程，但它们极易受到肩冲浪攻击。文献中已经提出了大量 PIN 输入方法来减轻此类攻击。不幸的是，这些方法都不能取代传统的 PIN 输入方法。本研究展示了对抵抗肩冲浪攻击的 PIN 输入方法的系统审查结果，以便可以提供阻碍其采用的主要挑战以及未来研究的机会。使用预定义的标准对七个数据库进行了系统搜索。由一位作者执行测试-再测试方法来提取数据。本综述共纳入 55 篇文章。审查结果表明，PIN输入方法主要分为直接输入和间接输入。用户研究是标准的研究方法，错误率和 PIN 输入时间是最常采用的可用性措施。该评论认为，基于录音的肩冲浪攻击是对 PIN 输入方法的主要威胁。错误率和 PIN 输入时间是广泛采用的可用性标准。审查表明，大多数 PIN 输入方法比传统方法需要更高的错误率和 PIN 输入时间。此外，应该解决缺乏标准评估框架的问题。该评论认为，基于录音的肩冲浪攻击是对 PIN 输入方法的主要威胁。错误率和 PIN 输入时间是广泛采用的可用性标准。审查表明，大多数 PIN 输入方法比传统方法需要更高的错误率和 PIN 输入时间。此外，应该解决缺乏标准评估框架的问题。该评论认为，基于录音的肩冲浪攻击是对 PIN 输入方法的主要威胁。错误率和 PIN 输入时间是广泛采用的可用性标准。审查表明，大多数 PIN 输入方法比传统方法需要更高的错误率和 PIN 输入时间。此外，应该解决缺乏标准评估框架的问题。