Double patterns could advance Android device security

Researchers have found that using multiple patterns to unlock an Android phone provides significantly more security than the current single-pattern method, and, in some cases, may be more secure than the four- and six-digit PIN unlocking method commonly used on Apple devices.

The situation

While Android users continue to be a large cross-section of mobile device users, there has not been a significant change in Android's pattern unlock authentication since initially deployed in 2008.

There have been various academic proposals to improve pattern locks, such as incorporating a password meter or expanding the 3 x 3 pattern grid to a 4 x 4 grid. However, these proposals require either a departure from the distinctly simple and popular pattern selection interface or the addition of interventions that may frustrate users.

The solution

To address these challenges, a research team led by Adam J. Aviv, associate professor of computer science at the George Washington University, suggests implementing double patterns, where a user selects two, concurrent unlock patterns that are entered one after the other and super-imposed on the same 3 x 3 grid.

The researchers conducted a survey of more than 600 mobile device users to evaluate the usability and security of double patterns. Participants selected a double pattern and answered questions about their experiences and perceptions. The researchers found:

Using a throttled attack model, where a limited number of guesses are allowed based on the device settings, double patterns significantly improve the security of pattern locks, and, in some cases, may be more secure than the four- and six-digit PIN unlocking method commonly used on Apple devices. The researchers note blocklists, which disallow "easy to guess" patterns, could also further improve security.

Requiring multiple pattern entries does not degrade the usability of double pattern unlocking; double pattern entry speeds were comparable to single pattern entry speeds and users were able to recall the double pattern as easily as the single pattern.

Participants reported positive sentiments, both in usability and perceived security, which would encourage adoption.

"Using two patterns to unlock an Android phone appears to provide a huge benefit for security with little to no impact on usability. Security-wise, double patterns are similar to other mobile authentication methods, like four- and six-digit PINs, and in many cases, double patterns were more secure. In fact, participants found double patterns so natural that many asked us when they are going to deployed by Google," says Adam J. Aviv, associate professor of computer science at the George Washington University.