Back-of-Device (BoD) interfaces have emerged as a promising solution to free up screen real estate in smartphones by offloading

PIN authentication is the first line of defense for protecting private data on many smartphone applications, such as lock screens, messengers, and banking apps. However, existing PIN authentication systems have several constraints regarding security, usability, and robustness. To go beyond their limitations, this paper presents TaPIN, a reliable system that authenticates smartphone users with the collaborative use of PINs and tap biometrics. A user is first instructed to enter her PIN by tapping a smartphone screen for authentication. During the PIN entry, the user's fingertip collides with the screen, producing user-specific vibration and sound signals. TaPIN then senses the tap-induced signals and the collision properties, e.g., pressures and sizes, using the smartphone's built-in sensors and leverages them as biometric features. That is, it authenticates the user by verifying not only the entered PIN but also the collected features. Our experiments with 20 real-world users demonstrate that this two-factor authentication system is easy to use, more secure than existing methods, and deployable without dedicated hardware. For example, it accurately authenticates users with an average EER of 1.9% in stationary environments and maintains a reasonable level of security regardless of devices, tap styles, and noise.

In this paper, we present TapAuth, a novel smartphone user authentication system that leverages vibrations generated from a user's tap inputs. TapAuth is based on the observation that the vibrations have their unique characteristic depending on the user due to differences in finger structure. Specifically, TapAuth collects audio and motion data using only built-in sensors, while users are entering PIN code. Then, it authenticates the user by verifying the validity of the code and comparing the collected data with a pre-built training dataset. Our experimental results with 20 real-world users show that TapAuth can achieve high accuracy.