Graphical Password Research Articles

A Fractal-Based Authentication Technique Using Sierpinski Triangles in Smart Devices.

The prevalence of smart devices in our day-to-day activities increases the potential threat to our secret information. To counter these threats like unauthorized access and misuse of phones, only authorized users should be able to access the device. Authentication mechanism provide a secure way to safeguard the physical resources as well the information that is processed. Text-based passwords are the most common technique used for the authentication of devices, however, they are vulnerable to a certain type of attacks such as brute force, smudge and shoulder surfing attacks. Graphical Passwords (GPs) were introduced as an alternative for the conventional text-based authentication to overcome the potential threats. GPs use pictures and have been implemented in smart devices and workstations. Psychological studies reveal that humans can recognize images much easier and quicker than numeric and alphanumeric passwords, which become the basis for creating GPs. In this paper a novel Fractal-Based Authentication Technique (FBAT) has been proposed by implementing a Sierpinski triangle. In the FBAT scheme, the probability of password guessing is low making system resilient against abovementioned threats. Increasing fractal level makes the system stronger and provides security against attacks like shoulder surfing.

Implementation of Chunks of Image Password in Cloud Computing System

This article proposed a graphical password authentication which uses chunks of images to overcome the loopholes present in the traditional authentication methods. The graphical password contains a selection of chunks of images which creates password for authenticating cloud users for accessing cloud services. The article includes the details of chunks of images authentication, algorithm and implementation of chunk of images.

Polynomial‐Based Google Map Graphical Password System against Shoulder‐Surfing Attacks in Cloud Environment

Text password systems are commonly used for identity authentication to access different kinds of data resources or services in cloud environment. However, in the text password systems, the main issue is that it is very hard for users to remember long random alphanumeric strings due to the long‐term memory limitation of the human brain. To address this issue, graphical passwords are accordingly proposed based on the fact that humans have better memory for images than alphanumeric strings. Recently, a Google map graphical password (GMGP) system is proposed, in which a specific location of Google Map is preset as a password for authentication. Unfortunately, the use of graphical passwords increases the risk of exposing passwords under shoulder‐surfing attacks. A snooper can easily look over someone’s shoulder to get the information of a location on map than a text password from a distance, and thus the shoulder‐surfing attacks are more serious for graphical passwords than for text passwords. To overcome this issue, we design a polynomial‐based Google map graphical password (P‐GMGP) system. The proposed P‐GMGP system can not only resist the shoulder‐surfing attacks effectively, but also need much fewer challenge‐response rounds than the GMGP system for authentication. Moreover, the P‐GMGP system is extended to allow a user to be authenticated in cloud environment effectively and efficiently.

The Coin Passcode: A Shoulder-Surfing Proof Graphical Password Authentication Model for Mobile Devices

Swiftness, simplicity, and security is crucial for mobile device authentication. Currently, most mobile devices are protected by a six pin numerical passcode authentication layer which is extremely vulnerable to Shoulder-Surfing attacks and Spyware attacks. This paper proposes a multi-elemental graphical password authentication model for mobile devices that are resistant to shoulder surfing attacks and spyware attacks. The proposed Coin Passcode model simplifies the complex user interface issues that previous graphical password models have, which work as a swift passcode security mechanism for mobile devices. The Coin Passcode model also has a high memorability rate compared to the existing numerical and alphanumerical passwords, as psychology studies suggest that human are better at remembering graphics than words. The results shows that the Coin Passcode is able to overcome the current shoulder-surfing and spyware attack vulnerability that existing mobile application numerical passcode authentication layers suffer from.

A New Shoulder Surfing and Mobile Key-Logging Resistant Graphical Password Scheme for Smart-Held Devices

In globalization of information, internet has played a vital role by providing an easy and fast access of information and systems to remote users. However, with ease for authentic users, it has made information resources accessible to unauthorized users too. To authorize legitimate user for the access of information and systems, authentication mechanisms are applied. Many users use their credentials or private information at public places to access their accounts that are protected by passwords. These passwords are usually text-based passwords and their security and effectiveness can be compromised. An attacker can steal text-based passwords using different techniques like shoulder surfing and various key logger software, that are freely available over internet. To improve the security, numerous sophisticated and secure authentication systems have been proposed that employ various biometric authentication systems, token-based authentication system etc. But these solutions providing such high-level security, require special modification in the design and hence, imply additional cost. Textual passwords that are easy to use but vulnerable to attacks like shoulder surfing, various image based, and textual graphical password schemes are proposed. However, none of the existing textual graphical passwords are resistant to shoulder surfing and more importantly to mobile key-logging. In this paper, an improved and robust textual graphical password scheme is proposed that uses sectors and colors and introducing randomization as the primary function for the character display and selection. This property makes the proposed scheme resistant to shoulder surfing and more importantly to mobile key-logging. It can be useful for authentication process of any smart held device application.

An Enhanced Electrocardiogram Biometric Authentication System Using Machine Learning

Traditional authentication systems use alphanumeric or graphical passwords, or token-based techniques that require "something you know and something you have". The disadvantages of these systems include the risks of forgetfulness, loss, and theft. To address these shortcomings, biometric authentication is rapidly replacing traditional authentication methods and is becoming a part of everyday life. The electrocardiogram (ECG) is one of the most recent traits considered for biometric purposes. In this work we describe an ECG-based authentication system suitable for security checks and hospital environments. The proposed system will help investigators studying ECG-based biometric authentication techniques to define dataset boundaries and to acquire high-quality training data. We evaluated the performance of the proposed system and found that it could achieve up to the 92 percent identification accuracy. In addition, by applying the Amang ECG (amgecg) toolbox within MATLAB, we investigated the two parameters that directly affect the accuracy of authentication: the ECG slicing time (sliding window) and the sampling time period, and found their optimal values.

Pixel Value Graphical Password Scheme: Compatibility of K-means Clustering Algorithm as Pixel Value Password Fault Tolerance Mechanism

In September 2018, the patent for pixel value graphical password scheme was granted in Malaysia. The graphical password scheme was designed to reduce the complexity of previously developed graphical password scheme where a user only requires to load their personal image as password instead of complex graphical challenge during authentication. As the guardian of digital access, Pixel Value Access Control was highly invincible from password pixel forgery attack where a little bit different pixel value derived from loaded image will deny the access. Only the original enrolled image from a registered user can be recognized by Pixel Value Access Control to authenticate the respective username. That fact makes the graphical password scheme is a trusted access control mechanism but, on the other hand, it makes users bound with the only original password pixel image file. Thus, Pixel Value Access Control need to be installed the pixel value fault tolerance mechanism where it could allow users to acquire their password pixel image file from various storage media. The clustering technique was suggested to solve this issue where it allows an altered pixel password being recognized as the same group of the original pixel password. There are number of clustering algorithms developed for various purposed and application of digital image clustering. K-Means algorithm is one the partition-based clustering algorithm that found to be the simplest and fastest clustering algorithm as suggested by many researchers. This paper is mainly to exhibit the selection of K-Means clustering algorithm became the crucial algorithm for Pixel Value Access Control password pixel fault tolerance algorithm. Background of this topic was briefly explained in introduction section, the implementation of K-Means algorithm as Pixel Value Access Control fault tolerance was elaborate in section 2 and followed by validation of the implementation in section 3. At the end of this paper, there is conclusion for this study and followed by list of references.

Study and Development of Graphical Authentication System for Secure File Transmission

The text-based password has been the most common practice from ancient days till present. Text based pass-words are also known for various threats, and it is prone to attacks like guessing attacks, dictionary attacks, social engineering attacks, brute force attacks, etc. The next immediate concept following the text based password is the graphical password schemes to improve password security and usability. In present days graphical passwords are being implemented more commonly. This approach is different from the traditional alpha numeric as it deals with images. In this paper a survey study is done to analyse various techniques used for authentication and also some of the methods for graphical authentication techniques like Pass Matrix, Cued Clicked points(CPP), CAPTCHA, Image distortion with text association, Doodle scheme, Standard recognition-based scheme, Stegno pin authentication method. Based on the existing methods, the future research can be done in order to improve security for graphical authentication.

A Graphical Authentication System Controlled by Eye Movement

Graphical password is a potential alternative to the traditional alphanumerical password due to its advantages of recognition and memory in the security system. Eye movement, a natural interaction modality, is a promising tool to replace the keyboard and the mouse in authentication. This paper proposes a graphical authentication system controlled by eye movement. In this keyboard-less authentication system, the user’s eye movements were recorded by eye-tracker as the control signal to generate recognition-based graphical passwords. The user test study has been conducted to verify the availability and effectiveness of this keyboard-less graphical authentication system. It’s also shown that the efficiency could be improved as the user getting familiar with this system.

An exploration of graphical password authentication for children

Abstract In this paper, we explore graphical passwords as a child-friendly alternative for user authentication. We evaluate the usability of three variants of the PassTiles graphical password scheme for children, and explore the similarities and differences in performance and preferences between children and adults while using these schemes. Children were most successful at recalling passwords containing images of distinct objects. Both children and adults prefer graphical passwords to their existing schemes, but password memorization strategies differ considerably between the two groups. Based on our findings, we provide recommendations for designing more child-friendly authentication schemes.

Adaptive Human-Machine Interactive Behavior Analysis With Wrist-Worn Devices for Password Inference.

The pervasiveness of wearable devices furnished with state-of-the-art sensors has shown the powerful capability in context-aware applications. However, embedded sensors also become targets for adversaries to launch potential side-channel attacks. In this paper, we present a self-adaptive and pretraining-independent pattern attack that infers a graphical password by recovering the victim's hand movement trajectory via motion sensors of a wrist-worn smart device. With the adaptive pattern inference algorithm, the discovered attack can be launched remotely without requiring previous training data from victims or the prior knowledge about the keyboard input settings. Toward the proposed attack, we create a method to detect the sliding behavior that draws a graphical password on the screen. We also propose an inference algorithm to generate password candidates from hand movement trajectories for different keypad input settings. We implement the discovered attack on a smartwatch and conduct experiments to evaluate the impact of this attack. The evaluation results show that for complex graphical patterns, with a single try, the attack can infer the passwords at a success rate as high as 80%, and the success rate can be further boosted to over 90% within five attempts, which reveals the overlooked privacy information threat caused by sensor data leakage.

My Personal Images as My Graphical Password

In 1996, Blonder introduced the first authentication system based on a graphical password. Since then, researchers have proposed several systems in the literature enhancing security properties to prevent brute-force, guessing, and shoulder-surfing attacks. However, many systems were developed using impersonal images, hindering their identification and retention. As a solution, Takada-Toike, and Herzberg-Margulies introduced systems using personal images in 2002 and 2012, respectively. Nonetheless, users require passing many stages during the authentication phase, making the systems unsecured. As a solution, we propose a system where each user creates a graphical personal password and needs to pass a stage. Security analysis demonstrates that the proposal can resist very well-known attacks, making it secure and useful for web services.

A Game Based Graphical Password Authentication System to Prevent Shoulder-Surfing

A Game Based Graphical Password Authentication System to Prevent Shoulder-Surfing

Graphical Password Authentication System Based On Persuasive Cued Click-Points

Graphical Password Authentication System Based On Persuasive Cued Click-Points

TCpC: a graphical password scheme ensuring authentication for IoT resources

In last few years, information world has come across one of the most appealing paradigms, namely Internet-of-Things (IoT). Both the industry as well as the academia is fascinated by the open issues and research challenges of Internet-of-Things. The enormity in the development, expansion, and advantages of the paradigm is unbelievable, and this results in the transition of the information world to this paradigm. At the same time, it raises the security concerns along with many other open issues towards the paradigm. This paper specifically focuses on the confidentiality component out of the three components of security triad, namely confidentiality, integrity and availability. Although researchers have high interest towards all the three components, but the questions posed by many researchers, academicians and end users raise major issues over ‘confidentiality’. Confidentiality is all about guaranteeing the authentic access to a piece of information or a service or even a resource, to a particular individual or computing device. The resource in question may be one of the resources of an IoT system. This can be achieved by deploying some authentication techniques. Here we discuss various types of authentication techniques, purposely putting our emphasis on one of the well-known authentication technique, viz. passwords. This work reviews the existing techniques, their drawbacks and claimed advantages of the upcoming password techniques. It also surveys some of the supportive methods for the naive users of password techniques. This paper aims at classifying, comparing and encapsulating the problems, demanded solutions and suggestions from relevant published technical and review articles in the field of authentication. This paper particularly highlights graphical password schemes. This proposes a naive graphical password scheme to assure the authentic access of IoT resources, namely TCpC. At the end we have mentioned the advantages of TCpC over other authentication schemes. We have also compared and analyzed the different proposed password schemes with our technique.

Spin Wheel Based Graphical Password Authentication Resistant to Peeping Attack

Gadgets outfitted with touch screens rule the present versatile market in view of high adaptability and great convenience. Numerous security applications keep running on such gadgets. For user verification recalling or recognizing a secret word is testing errand in touch screen based gadgets. A graphical based secret key is a standout amongst the most encouraging and upcoming option for touch based devices. As per research, human brain can recall pictures more effectively than content. In this paper we introduce a novel spin wheel based authentication system targeting the touch screen based versatile and handheld gadgets. The user needs to rotate a set of spin wheels to get authenticated .Usability Study was directed to investigate the ease of use and security of the proposed authentication mechanism.

Study on a Biometric Authentication Model based on ECG using a Fuzzy Neural Network

Traditional authentication methods use numbers or graphic passwords and thus involve the risk of loss or theft. Various studies are underway regarding biometric authentication because it uses the unique biometric data of a human being. Biometric authentication technology using ECG from biometric data involves signals that record electrical stimuli from the heart. It is difficult to manipulate and is advantageous in that it enables unrestrained measurements from sensors that are attached to the skin. This study is on biometric authentication methods using the neural network with weighted fuzzy membership functions (NEWFM). In the biometric authentication process, normalization and the ensemble average is applied during preprocessing, characteristics are extracted using Haar-wavelets, and a registration process called “training” is performed in the fuzzy neural network. In the experiment, biometric authentication was performed on 73 subjects in the Physionet Database. 10-40 ECG waveforms were tested for use in the registration process, and 15 ECG waveforms were deemed the appropriate number for registering ECG waveforms. 1 ECG waveforms were used during the authentication stage to conduct the biometric authentication test. Upon testing the proposed biometric authentication method based on 73 subjects from the Physionet Database, the TAR was 98.32% and FAR was 5.84%.

Sketch-Based User Authentication With a Novel String Edit Distance Model

The vast majority of user authentication in digital applications is based on alphanumeric passwords. Yet, due to severe problems that might arise with this approach, various efforts have been made in the last decade to replace this authentication paradigm. One candidate for the prospective paradigm shift might be found in the field of graphical passwords. The present paper introduces a novel framework for user authentication based on freehand sketches. The basic idea is that during the registration phase a user draws an arbitrary sketch in a specific drawing canvas (rather than typing a password). Registered users can then be authenticated whenever they are able to reproduce their personal sketch with sufficient precision. The major challenge of such a system is twofold. First, it has to provide a certain degree of error-tolerance such that the authentication of genuine users can be smoothly accomplished. Second, the system should detect even subtle forgeries and reject possible intruders. The main contributions of this paper are as follows. First, we formally represent the underlying sketches by means of strings and present a general authentication algorithm that is based on structural pattern recognition. Second, we present a novel cost model that is particularly useful in conjunction with string matching. Third, by means of an exhaustive empirical investigation using both random and skilled forgeries (stemming from several hundreds of users) we empirically confirm the feasibility of this particular authentication framework in a real-world scenario.

A Shoulder Surfing Resistant Graphical Authentication System

Authentication based on passwords is used largely in applications for computer security and privacy. However, human actions such as choosing bad passwords and inputting passwords in an insecure way are regarded as “the weakest link” in the authentication chain. Rather than arbitrary alphanumeric strings, users tend to choose passwords either short or meaningful for easy memorization. With web applications and mobile apps piling up, people can access these applications anytime and anywhere with various devices. This evolution brings great convenience but also increases the probability of exposing passwords to shoulder surfing attacks. Attackers can observe directly or use external recording devices to collect users’ credentials. To overcome this problem, we proposed a novel authentication system PassMatrix, based on graphical passwords to resist shoulder surfing attacks. With a one-time valid login indicator and circulative horizontal and vertical bars covering the entire scope of pass-images, PassMatrix offers no hint for attackers to figure out or narrow down the password even they conduct multiple camera-based attacks. We also implemented a PassMatrix prototype on Android and carried out real user experiments to evaluate its memorability and usability. From the experimental result, the proposed system achieves better resistance to shoulder surfing attacks while maintaining usability.

Comparison of Graphical Passwords Using ISO 9126

This article is to learn the characteristics of graphical passwords by comparing different categories of graphical passwords with the ISO 9126 model. The ISO 9126 model is divided into six parts, which are usability, reliability, functionality, maintainability, efficiency, and portability. Each part listed is sub-categorised by the standard and is used to evaluate the quality of a product. Multiple graphical passwords are chosen from different classification of graphical passwords for thirty users to test and fill in the survey. Then a survey was conducted to compare each of these five categories of graphical passwords based on the ISO 9126 model. Thirty users of different ages and gender were invited to the booth to test the graphical password systems and fill in survey. The survey results as described in the article show us which category of graphical passwords contains more of the ISO 9126 characteristics.