Look Closer to Touch Behavior-enabled Android Pattern Locks: A Study in the Wild

Android pattern lock is one of the most popular unlocking mechanisms on the Android platform. In order to enhance the security of Android’s unlocking functionality, a number of researchers have tried to combine touch biometrics with the pattern lock. Several studies have reported adequate— even excellent—authentication results, but, unlike fingerprint-and face recognition-based authentication, no biometrics-enabled pattern lock exists in the Android marketplace. Furthermore, most studies of biometrics-enabled pattern locks were conducted in controlled lab environments. As such, in this work, our goal is to investigate and validate the performance of touch behavior-enabled Android pattern locks in a more practical scenario, in which users have to download the application and learn to use it by themselves (as was often the case during the pandemic). During the course of our investigation, we collected substantial data, namely, the properties provided by the Android API for motion events, as well as measurements that could be extracted from the devices’ sensors. Our investigation found that touch-enabled Android pattern locks could achieve an average equal error ratio of 23.5% for user authentication—without changing the process from the user’s perspective. Next, we modified the user experience such that each user would train the authenticator with different fingers, similar to fingerprint-based authentication. With this modification, an average equal error ratio of 13.5% was achieved.