  Mobile authentication is indispensable for preventing unauthorized access to
multi-touch mobile devices. Existing mobile authentication techniques are often
cumbersome to use and also vulnerable to shoulder-surfing and smudge attacks.
This paper focuses on designing, implementing, and evaluating TouchIn, a
two-factor authentication system on multi-touch mobile devices. TouchIn works
by letting a user draw on the touchscreen with one or multiple fingers to
unlock his mobile device, and the user is authenticated based on the geometric
properties of his drawn curves as well as his behavioral and physiological
characteristics. TouchIn allows the user to draw on arbitrary regions on the
touchscreen without looking at it. This nice sightless feature makes TouchIn
very easy to use and also robust to shoulder-surfing and smudge attacks.
Comprehensive experiments on Android devices confirm the high security and
usability of TouchIn.
