{"id":"https://openalex.org/W3089170408","doi":"https://doi.org/10.1145/3414844","title":"Exploiting Behavioral Side Channels in Observation Resilient Cognitive Authentication Schemes","display_name":"Exploiting Behavioral Side Channels in Observation Resilient Cognitive Authentication Schemes","publication_year":2020,"publication_date":"2020-09-28","ids":{"openalex":"https://openalex.org/W3089170408","doi":"https://doi.org/10.1145/3414844","mag":"3089170408"},"language":"en","primary_location":{"id":"doi:10.1145/3414844","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3414844","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016670591","display_name":"Benjamin Zi Hao Zhao","orcid":"https://orcid.org/0000-0002-2774-2675"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I31746571","display_name":"UNSW Sydney","ror":"https://ror.org/03r8z3t63","country_code":"AU","type":"education","lineage":["https://openalex.org/I31746571"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Benjamin Zi Hao Zhao","raw_affiliation_strings":["University of New South Wales and Data61, CSIRO, Australia"],"raw_orcid":"https://orcid.org/0000-0002-2774-2675","affiliations":[{"raw_affiliation_string":"University of New South Wales and Data61, CSIRO, Australia","institution_ids":["https://openalex.org/I42894916","https://openalex.org/I31746571","https://openalex.org/I1292875679"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049859678","display_name":"Hassan Jameel Asghar","orcid":"https://orcid.org/0000-0001-6168-6497"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I99043593","display_name":"Macquarie University","ror":"https://ror.org/01sf06y89","country_code":"AU","type":"education","lineage":["https://openalex.org/I99043593"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Hassan Jameel Asghar","raw_affiliation_strings":["Macquarie University and Data61, CSIRO, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Macquarie University and Data61, CSIRO, Australia","institution_ids":["https://openalex.org/I99043593","https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5040251515","display_name":"Mohamed Ali K\u00e2afar","orcid":"https://orcid.org/0000-0003-2714-0276"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I99043593","display_name":"Macquarie University","ror":"https://ror.org/01sf06y89","country_code":"AU","type":"education","lineage":["https://openalex.org/I99043593"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Mohamed Ali Kaafar","raw_affiliation_strings":["Macquarie University and Data61, CSIRO, Australia"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Macquarie University and Data61, CSIRO, Australia","institution_ids":["https://openalex.org/I99043593","https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5089528260","display_name":"Francesca Trevisan","orcid":"https://orcid.org/0000-0002-0326-3792"},"institutions":[{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Francesca Trevisan","raw_affiliation_strings":["University of Surrey, United Kingdom"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Surrey, United Kingdom","institution_ids":["https://openalex.org/I28290843"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5001627689","display_name":"Haiyue Yuan","orcid":"https://orcid.org/0000-0001-6084-6719"},"institutions":[{"id":"https://openalex.org/I28290843","display_name":"University of Surrey","ror":"https://ror.org/00ks66431","country_code":"GB","type":"education","lineage":["https://openalex.org/I28290843"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Haiyue Yuan","raw_affiliation_strings":["University of Surrey, United Kingdom"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Surrey, United Kingdom","institution_ids":["https://openalex.org/I28290843"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.17607303,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"24","issue":"1","first_page":"1","last_page":"33"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11800","display_name":"User Authentication and Security Systems","score":0.998199999332428,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11818","display_name":"Nicotinic Acetylcholine Receptors Study","score":0.9943000078201294,"subfield":{"id":"https://openalex.org/subfields/1312","display_name":"Molecular Biology"},"field":{"id":"https://openalex.org/fields/13","display_name":"Biochemistry, Genetics and Molecular Biology"},"domain":{"id":"https://openalex.org/domains/1","display_name":"Life Sciences"}},{"id":"https://openalex.org/T11707","display_name":"Gaze Tracking and Assistive Technology","score":0.9897000193595886,"subfield":{"id":"https://openalex.org/subfields/1709","display_name":"Human-Computer Interaction"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6607578992843628},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6087391972541809},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5291308164596558},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.5129408240318298},{"id":"https://openalex.org/keywords/resilience","display_name":"Resilience (materials science)","score":0.4898662269115448},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.4775715172290802},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.47027355432510376},{"id":"https://openalex.org/keywords/channel","display_name":"Channel (broadcasting)","score":0.45830419659614563},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.39652448892593384},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.3698372542858124},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.2650306820869446}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6607578992843628},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6087391972541809},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5291308164596558},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.5129408240318298},{"id":"https://openalex.org/C2779585090","wikidata":"https://www.wikidata.org/wiki/Q3457762","display_name":"Resilience (materials science)","level":2,"score":0.4898662269115448},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.4775715172290802},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.47027355432510376},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.45830419659614563},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.39652448892593384},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.3698372542858124},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.2650306820869446},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3414844","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3414844","pdf_url":null,"source":{"id":"https://openalex.org/S4210174050","display_name":"ACM Transactions on Privacy and Security","issn_l":"2471-2566","issn":["2471-2566","2471-2574"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Privacy and Security","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G5678455973","display_name":null,"funder_award_id":"EP/N020111/1","funder_id":"https://openalex.org/F4320334627","funder_display_name":"Engineering and Physical Sciences Research Council"}],"funders":[{"id":"https://openalex.org/F4320334627","display_name":"Engineering and Physical Sciences Research Council","ror":"https://ror.org/0439y7842"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":21,"referenced_works":["https://openalex.org/W128619364","https://openalex.org/W189499990","https://openalex.org/W1973831058","https://openalex.org/W1980015812","https://openalex.org/W1980732959","https://openalex.org/W1986938149","https://openalex.org/W2039428813","https://openalex.org/W2105828786","https://openalex.org/W2107465855","https://openalex.org/W2114661209","https://openalex.org/W2124885613","https://openalex.org/W2154053567","https://openalex.org/W2157007820","https://openalex.org/W2164161677","https://openalex.org/W2167020116","https://openalex.org/W2324715755","https://openalex.org/W2395639500","https://openalex.org/W2468114283","https://openalex.org/W2539824335","https://openalex.org/W2997591727","https://openalex.org/W4206109607"],"related_works":["https://openalex.org/W3180573957","https://openalex.org/W3081831718","https://openalex.org/W4297884308","https://openalex.org/W2139816293","https://openalex.org/W2990618290","https://openalex.org/W3090064150","https://openalex.org/W3211894641","https://openalex.org/W4286859242","https://openalex.org/W99107328","https://openalex.org/W1974516981"],"abstract_inverted_index":{"Observation":[0],"Resilient":[1],"Authentication":[2],"Schemes":[3],"(ORAS)":[4],"are":[5],"a":[6,15,22,74,101,116,138,168,181,229,244],"class":[7],"of":[8,38,97],"shared":[9],"secret":[10,88,122,158,189,206],"challenge\u2013response":[11,47,213],"identification":[12],"schemes":[13],"where":[14],"user":[16,110,247],"mentally":[17],"computes":[18],"the":[19,34,78,83,87,91,95,121,127,151,157,164,176,188,191,197,205],"response":[20],"via":[21,45,56],"cognitive":[23,79],"function":[24],"to":[25,67,90,100,119,147],"authenticate":[26],"herself":[27],"such":[28,124],"that":[29,109,156,185,204],"eavesdroppers":[30],"cannot":[31],"readily":[32],"extract":[33],"secret.":[35,152],"Security":[36],"evaluation":[37],"ORAS":[39,201],"generally":[40],"involves":[41],"quantifying":[42],"information":[43,54,84,134,149],"leaked":[44,55,85],"observed":[46],"pairs.":[48],"However,":[49],"little":[50],"work":[51],"has":[52],"evaluated":[53],"human":[57],"behavior":[58,111],"while":[59],"interacting":[60],"with":[61,210,243],"these":[62],"schemes.":[63],"A":[64],"common":[65],"way":[66],"achieve":[68],"observation":[69],"resilience":[70],"is":[71,166,225],"by":[72],"including":[73],"modulus":[75,139,193],"operation":[76,140],"in":[77,123,172],"function.":[80],"This":[81],"minimizes":[82],"about":[86,150],"due":[89],"many-to-one":[92],"map":[93],"from":[94],"set":[96],"possible":[98],"secrets":[99],"given":[102],"response.":[103],"In":[104,221],"this":[105],"work,":[106],"we":[107],"show":[108,155,203],"can":[112,135,159,207],"be":[113,161,208],"used":[114],"as":[115],"side":[117],"channel":[118],"obtain":[120],"ORAS.":[125],"Specifically,":[126],"user\u2019s":[128],"eye-movement":[129],"patterns":[130],"and":[131,179,202],"associated":[132],"timing":[133],"deduce":[136],"whether":[137],"was":[141],"performed":[142],"(a":[143],"fundamental":[144],"design":[145],"element)":[146],"leak":[148],"We":[153,174,195,238],"further":[154],"still":[160],"retrieved":[162,209],"if":[163],"deduction":[165],"erroneous,":[167],"more":[169],"likely":[170],"case":[171],"practice.":[173],"treat":[175],"vulnerability":[177],"analytically":[178],"propose":[180],"generic":[182],"attack":[183,198,224,236,242],"algorithm":[184],"iteratively":[186],"obtains":[187],"despite":[190],"\u201cfaulty\u201d":[192],"information.":[194],"demonstrate":[196],"on":[199,227],"five":[200],"considerably":[211],"less":[212],"pairs":[214],"than":[215],"non-side-channel":[216,235],"attacks":[217],"(e.g.,":[218],"algebraic/statistical":[219],"attacks).":[220],"particular,":[222],"our":[223,241],"applicable":[226],"Mod10,":[228],"one-time-pad-based":[230],"scheme,":[231],"for":[232],"which":[233],"no":[234],"exists.":[237],"field":[239],"test":[240],"small-scale":[245],"eye-tracking":[246],"study.":[248]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}