A visibility-based upper bound for android unlock patterns

The Android pattern unlock is a popular graphical password scheme, where a user is presented a 3 × 3 grid and required to draw a pattern on the onscreen grid. Each pattern is a sequence of at least four contact points with some restrictions. Theoretically, the security level of unlock patterns is determined by the size of the pattern space. However, the number of possible patterns is only known for 3 × 3 and 4 × 4 grids, which was computed by brute-force enumeration. The only mathematical formula for the number of possible patterns is a permutation-based upper bound. In this article, we present an improved upper bound by counting the number of "visible" points that can be directly reached by a point.