Graphical Authentication Scheme Research Articles

Securing Access to Internet of Medical Things Using a Graphical-Password-Based User Authentication Scheme

Digital healthcare services have seen significant growth in this decade and many new technologies have been thoroughly examined to provide efficient services through secure infrastructures. The Internet of Medical Things (IoMT) revitalizes a healthcare infrastructure by creating an interconnected, intelligent, accessible, and efficient network. While there have been many studies on possible device authentication techniques for the IoMT, there is still much work to be done in user authentication to provide sustainable IoT solutions. Graphical passwords, which use visual content such as images instead of traditional text-based passwords, can help users authenticate themselves. However, current schemes have limitations. Therefore, this paper proposes a novel graphical authentication scheme that uses multiple factors to register and authenticate users using simple arithmetic operations, machine learning for hand gesture recognition, and medical images for recall purposes. The proposed method is designed to keep the authentication process simple, memorable, and robust. To evaluate the proposed scheme, we use the Post-Study System Usability Questionnaire (PSSUQ) to compare it with PIN-based and pattern-based authentication techniques. While comparing treatment and comparison groups, system quality showed a 16.7% better score, information quality a 25% increase, interface quality a 40% increase, and overall quality showed a 25% increase. The proposed method successfully revitalizes the use of graphical passwords, specifically in the field of IoMT, by developing a user-friendly, satisfying, and robust authentication scheme.

An Enhanced Graphical Authentication Scheme Using Multiple-Image Steganography

Most remote systems require user authentication to access resources. Text-based passwords are still widely used as a standard method of user authentication. Although conventional text-based passwords are rather hard to remember, users often write their passwords down in order to compromise security. One of the most complex challenges users may face is posting sensitive data on external data centers that are accessible to others and do not be controlled directly by users. Graphical user authentication methods have recently been proposed to verify the user identity. However, the fundamental limitation of a graphical password is that it must have a colorful and rich image to provide an adequate password space to maintain security, and when the user clicks and inputs a password between two possible grids, the fault tolerance is adjusted to avoid this situation. This paper proposes an enhanced graphical authentication scheme, which comprises benefits over both recognition and recall-based graphical techniques besides image steganography. The combination of graphical authentication and steganography technologies reduces the amount of sensitive data shared between users and service providers and improves the security of user accounts. To evaluate the effectiveness of the proposed scheme, peak signal-to-noise ratio and mean squared error parameters have been used.

EYEDi: Graphical Authentication Scheme of Estimating Your Encodable Distorted Images to Prevent Screenshot Attacks

Graphical authentication schemes have the advantage of being more memorable than conventional passwords. Although some image distortion methods have been proposed to prevent the risks of over-the-shoulder attacks (OSAs), these methods cannot prevent camera recording attacks, as the key images are the same each time. In this study, we propose a graphical authentication scheme that generates various distorted images, named Estimating Your Encodable Distorted images (EYEDi). EYEDi generates distorted images by applying several image processing filters to the original images. Moreover, EYEDi estimates the appropriate image processing filter strength based on the authentication data. To measure attack resistance, twenty participants performed three types of attacks (OSA, camera recording attack, and screenshot) 300 times, each using existing methods and EYEDi. The classification error rate of all three types of attacks showed that EYEDi had a lower classification error rate between the legitimate user and attackers. Especially for the screenshot attack, which is the most severe threat model, the existing method was completely broken through, while EYEDi prevented the attacks with a classification error rate of 10%. This result shows that EYEDi can eliminate the screenshot attacker by using the difference in authentication times and a simple improvement in defense performance.

From hot-spots towards experience-spots: Leveraging on users’ sociocultural experiences to enhance security in cued-recall graphical authentication

This paper suggests a novel cued-recall-based graphical authentication method, which leverages on users’ sociocultural experiences for improving the security and memorability of selected secrets. We evaluated the suggested approach in the context of three user studies (n = 139): a) an eye-tracking study (n = 42) focusing on security in terms of resistance to brute-force attacks; b) a two-week study (n = 71) focusing on memorability and login usability; and c) a controlled in-lab user study (n = 26) focusing on human attack vulnerabilities among people sharing common sociocultural experiences. Analysis of results revealed that the suggested approach influenced visual behavior strategies of end-users, which subsequently resulted in significantly stronger passwords created on images reflecting their prior experiences than on images unfamiliar to them. Simultaneously, both reference and control groups performed similarly in terms of memorability and login efficiency and effectiveness. On the downside, the suggested approach introduces password guessing vulnerabilities in terms of allowing attackers who share common experiences with the end-users to more easily identify regions of their selected secrets. Findings point towards a new direction for delivering personalized cued-recall graphical authentication schemes that depict image semantics bootstrapped to users’ real-life experiences.

Multifactor Pattern Implicit Authentication

Text and pattern passwords are vulnerable to different attacks like shoulder surfing attacks, guessing attacks, and smudge attacks. To resist these attacks, this article proposes an OP-Grid technique; an implicit graphical authentication scheme having different patterns on every Login session. With a one-time Login pointer, the user creates his password pattern. A legitimate user is authenticated not only through the user-created pattern but also the way he performs it using finger velocity and stroke time features. OP-Grid is implemented on android cell phones, gathered samples from 33 volunteers, and the experimental study carried out to evaluate its accuracy and usability.

CogniPGA: Longitudinal Evaluation of Picture Gesture Authentication with Cognition-Based Intervention

Abstract There is evidence that the visual behavior of users when creating graphical passwords affects the password strength. Adopting a cognitive style perspective in the interpretation of the results of recent studies revealed that users, depending on their cognitive style, follow different visual exploration paths when creating graphical passwords which affected the password strength. To take advantage of the inherent abilities of people, we proposed CogniPGA, a cued-recall graphical authentication scheme where a cognition-based intervention using gaze data is applied. This paper presents the longitudinal evaluation of the proposed scheme in terms of security, memorability, and usability from a cognitive style perspective. Results strengthen the assumptions that understanding and using the inherent cognitive characteristics of users could enable the design of user-first authentication schemes, where no compromises need to be made on security for benefiting usability or the other way around.

Graphical Authentication Passcode Memorability: Context, Length, and Number

Authentication verifies users’ identities to protect against costly attacks. Graphical authentication schemes utilize pictures as passcodes rather than strings of characters, numbers, and symbols. Pictures are more memorable than alphanumeric passwords. Two studies investigated the memorability of graphical passcodes when users need to remember multiple passcodes or longer passcodes. Longer passcodes provide advantages to security by protecting against brute force attacks, and multiple passcodes need to be investigated as users need to authenticate for numerous accounts. It was found that participants have strong item retention for passcodes of up to eight images and for up to eight accounts. Also, these studies examined whether context can facilitate memorability. The impact of context was not found as assumed in the literature. Overall, memorability was still higher for all the number and length passcode conditions compared with alphanumeric passwords. These studies take steps toward understanding the readiness of graphical schemes as an authentication option.

Research and Development of User Authentication using Graphical Passwords: A Prospective Methodology

Nowadays in information security user authentication is a very important task. In most of the computer, user authentication depends on the alphanumeric username and password. It means text-based password. But, this is not highly secure because of hackers can easily break the password. Brute force attack, dictionary attack, guessing attack etc. these all are some possible attacks on the password. If the user chooses a difficult password to prevent the system from the attackers which is very much harder for the user to remember such a difficult password. So, to resolve this problem introduced a new technique called graphical password authentication. This paper presents a detailed survey of user authentication techniques using a graphical password. It contains basically two type approaches. They are recognition-based and recall-based approaches. This survey discusses the different techniques about Graphical password authentication and their advantages and limitations. The survey provides a roadmap for the development of new graphical authentication scheme.

A Secure Hybrid Authentication Scheme Using Passpoints and Press Touch Code

With the increasing capabilities of smart devices, keeping them secure has become a major concern. To mitigate that concern, over the last few years, several new classes of authentication schemes have been proposed. Graphical Authentication (GA) is one of those classes and is the focus of this paper. The GA schemes are more popular and preferable for smart devices due to their: heavily graphics-oriented nature, higher memorability over text-based schemes, and no additional hardware requirement. However, most of these GA schemes are unable to resist several prominent attacks, namely shoulder surfing, smudge, and brute force. Therefore, in this paper, a new hybrid authentication scheme is proposed which seamlessly integrates two independent yet popular authentication schemes — Passpoints and Press Touch Code or PTC. The purpose of this new scheme is to ensure a higher level of security by resisting those prominent attacks. The proposed scheme is implemented on the Android operating system and is tested on Huawei P9 plus device, a pressure sensitivity screen enabled device, which is compulsory for the PTC scheme. The performance of the proposed technique is evaluated for security, functionality, and usability. When it is compared with other similar schemes, it outperforms the existing schemes.

SECURE GRAPHICAL PASSWORD SCHEME

In the world of computer applications authentication is the main process of granting access for an individual to get control over the services provided by different service providers. It is the process of identification of particular individual, unique username and password are used. Username and text-based password are the most commonly used technique in authentication, use of this technique is very popular in web applications. Lots of work has been done in the field of authentication. Conventional technique includes the text-based password, which is the combination of alphanumeric letters. On the other side of the authentication Graphical Password techniques are popular among handheld devices, the main motivation behind developing such kind of authentication technique is to provide strong but easy to remember password. Graphical authentication schemes are in use from decades, they have some limitations in early days, but comparatively the schemes which are in use today are secure and trust worthy. In this paper a technique for graphical authentication has been proposed based on the previous work, which can be implemented on the web application. The proposed authentication scheme is made secure using the homomorphic encryption technique to avoid the security issue in database.

Shoulder Surfing Resistant Graphical Authentication Scheme for Web Based Applications

Since the design and development of the first graphical authentication pioneered by Blonder in 1996, numerous research has been conducted on this area to be used in different scenario especially on the Internet. One of the major motivators is the picture superiority which as studies have shown, states that image/pictures provides higher memorability as opposed to Text based authentication. However, graphical authentication is still faced with some challenges. In this paper, a shoulder surfing resistant graphical authentication scheme is proposed to tackle the major issues related to the graphical authentication schemes developed. In summary, the proposed scheme provides a high level of resistance to shoulder surfing attacks, mitigating the need to upload pictures and aids in finding chosen objects in the scheme. Finally, the schemes still have some vulnerabilities thus, concluding that there cannot be a perfect graphical authentication scheme; each scheme has its merits and demerits making it a suitable candidate for different environment and/or event based on its architecture.

Security Requirements Metrics for Pattern-Lock Applications on Mobile Devices

Pattern-Lock is one of graphical authentication schemes that shows high popularity today. Based on recent research, the security requirements metrics of Pattern-Lock applications have not proposed yet. The goal of this study is to define security requirements metrics for Pattern-Lock applications on mobile devices. Our study has identified 12 threat statements and 18 requirements statements by analyzing STRIDE (Spoofing the identity, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) and Extended Misuse Case diagram. To develop the metrics we have used Goal-Question-Metric (GQM) paradigm. Based on these, we develop 3 Goals and 7 Questions and resulted in 20 metrics for security requirements. The metrics have been evaluated using 30 App Locker Android applications, and the results show that some metrics have higher values than others. Number of Pattern Characteristics that Successfully Detected, Ability to Relock, and Grid Size metrics have the three highest values. These metrics requires higher priorities to look into when developers need to build the App Locker applications. Moreover, developers should ensure that App Locker applications have values higher than average of security goals and metrics achievements. Index Terms—GQM, Pattern-Lock, Requirement Statements, Security Requirements Metrics, Threat Statements.