Password Patterns Research Articles

Graphical Password Authentication

A pattern password is an authentication system that works when a user selects images in a specific sequence displayed on a graphical user interface (GUI). For this reason, the graphical password method is called Graphical User Authentication (GUA). The most common way to authenticate a computer is by using an alphanumeric username and password. This method has been shown to have significant drawbacks. For example, users tend to choose passwords that are easy to guess. On the other hand, if a password is difficult to guess, it is often difficult to remember. To overcome these security issues, researchers have developed an authentication method that uses colours and images as passwords. In this research paper, we present a comprehensive overview of existing pattern password methods and introduce our own theory. Graphic cryptosystems have been proposed as a possible alternative to text-based schemes because people can remember colours and images better than text. Colours and Images are usually easier to remember or recognize than text. In this composition, this paper provides a comprehensive overview of existing graphical password ways. These ways fell into two orders: recognition-based and memory-based approaches. Thereafter the strengths and limitations of each approach and coming research directions in this field will be talked over in detail.

Wi-Fi Handshake: analysis of password patterns in Wi-Fi networks.

This article seeks to provide a snapshot of the security of Wi-Fi access points in the metropolitan area of A Coruña. First, we discuss the options for obtaining a tool that allows the collection and storage of auditable information from Wi-Fi networks, from location to signal strength, security protocol or the list of connected clients. Subsequently, an analysis is carried out aimed at identifying password patterns in Wi-Fi networks with WEP, WPA and WPA2 security protocols. For this purpose, a password recovery tool called Hashcat was used to execute dictionary or brute force attacks, among others, with various word collections. The coverage of the access points in which passwords were decrypted is displayed on a heat map that represents various levels of signal quality depending on the signal strength. From the handshakes obtained, and by means of brute force, we will try to crack as many passwords as possible in order to create a targeted and contextualized dictionary both by geographical location and by the nature of the owner of the access point. Finally, we will propose a contextualized grammar that minimizes the size of the dictionary with respect to the most used ones and unifies the decryption capacity of the combination of all of them.

Machine Learning Based Password Strength Analysis

Passwords, as the most used method of authentication because to its ease of implementation, allow attackers to get access to the accounts owned by others by means of cracking passwords. This is cause of the similar patterns that users use to create a password, like dictionary words, common phrases, person and location names, keyboard pattern, and so on. Multiple password cracking techniques had been introduced to predict the password offline or online, with the majority of records say the one with weak password or familiar password patterns being cracked. This suggested prototype implements numerous machine learning methods such as Decision Tree (DT), Nave Bayes (NB), Logistic Regression (LR), and Random Forest (RF) on a web application in real time to force users to choose a secure password. This results in the user’s account being logged into if particularly the password strength from more than half of the algorithms is strong.

Vibration-Based Pattern Password Approach for Visually Impaired People

The pattern password method is amongst the most attractive authentication methods and involves drawing a pattern; this is seen as easier than typing a password. However, since people with visual impairments have been increasing their usage of smart devices, this method is inaccessible for them as it requires them to select points on the touch screen. Therefore, this paper exploits the haptic technology by introducing a vibration-based pattern password approach in which the vibration feedback plays an important role. This approach allows visually impaired people to use a pattern password through two developed vibration feedback: pulses, which are counted by the user, and duration, which has to be estimated by the user. In order to make the proposed approach capable to prevent shoulder-surfing attacks, a camouflage pattern approach is applied. An experimental study is conducted to evaluate the proposed approach, the results of which show that the vibration pulses feedback is usable and resistant to shoulder-surfing attacks.

User-Centric Adaptive Password Policies to Combat Password Fatigue

Today, online users will have an average of 25 password-protected accounts online, yet use, on average, 6.5 passwords. The excessive cognitive burden of remembering large amounts of passwords causes Password Fatigue. Therefore users tend to reuse passwords or recycle password patterns whenever prompted to change their passwords regularly. Researchers have created Adaptive Password Policies to prevent users from creating new passwords similar to previously created ones. However, this approach creates user frustration as it neglects users’ cognitive burden. This paper proposes a novel User-Centric Adaptive Password Policy (UCAPP) Framework for password creation and management that assigns users system-generated passwords based on a cognitive-behavioural agent-based model. The framework comprises a Password Policy Assignment Test (PassPAST), a Cognitive Burden Scale (CBS), a User Profiling Algorithm, and a Password Generator (PassGEN). The framework creates tailor-made password policies that maintain password memorability for users of different cognitive thresholds without sacrificing password strength and entropy. The framework successfully created 30-40% stronger passwords for Critical users and random (non-mnemonic) passwords for Typical users based on each individual’s cognitive password thresholds in a preliminary test.

Fine-Grained and Context-Aware Behavioral Biometrics for Pattern Lock on Smartphones

Pattern lock has been widely used in smartphones as a simple and effective authentication mechanism, which however is shown to be vulnerable to various attacks. In this paper, we design a novel authentication system for more secure pattern unlocking on smartphones. The basic idea is to utilize various behavior information of the user during pattern unlocking as additional authentication fingerprints, so that even if the pattern password is leaked to an attacker, the system remains safe and protected. To accommodate a variety of user contexts by our system, a context-aware module is proposed to distinguish any of such contexts (e.g., body postures when drawing the pattern) and use it to guide the authentication. Moreover, we design a polyline weighted strategy with overlapping based on the consistency of pattern lock, which analyzes the behavior information of the user during the unlock process in a fine-grained manner and takes an overall consideration the results of different polylines. Based on 14,850 samples collected from 77 participants, we have extensively evaluated the proposed system. The results demonstrate that it outperforms state-of-the-art implicit authentication based pattern lock approaches, and that each key module in our system is effective.

Authenticating Passwords by Typing Pattern Biometrics

Passwords are a common measure used in Authentication systems to make sure that the users are who they say they are. The complexity of these Passwords is relied on while ensuring security. However, the role of complexity is limited. Users are forced to write down complex passwords since easy ones are easily guessed. This study aimed at evaluating the uniqueness of typing patterns of password holders so as to strengthen the authentication process beyond matching the string of characters. Using our own dataset, this research experimentally showed that k Nearest Neighbor algorithm using Euclidean distance as the metric, produces sufficient results to distinguish samples and detect whether they are from the same authentic user or from an impostor based on a threshold that was computed. Results obtained indicated that typing patterns are distinct even on simple guessable passwords and that typing pattern biometrics strengthens the authentication process. This research extends work in typing pattern analysis using k Nearest Neighbor machine learning approach to auto detect the password pattern of the authentic and non-authentic users. It also provides an investigation and assessment to the effect of using different k values of the KNN algorithm. Further to this field is the methodology for calculating an optimal threshold value with higher accuracy levels that acted as a basis for rejection or acceptance of a typing sample. Additionally is an introduction of a new feature metric of a combined dataset which is a concatenation of both the dwell and latency timings. A comparison of performance for independent and a combined dataset of the feature metrics was also evaluated.

Multifactor Pattern Implicit Authentication

Text and pattern passwords are vulnerable to different attacks like shoulder surfing attacks, guessing attacks, and smudge attacks. To resist these attacks, this article proposes an OP-Grid technique; an implicit graphical authentication scheme having different patterns on every Login session. With a one-time Login pointer, the user creates his password pattern. A legitimate user is authenticated not only through the user-created pattern but also the way he performs it using finger velocity and stroke time features. OP-Grid is implemented on android cell phones, gathered samples from 33 volunteers, and the experimental study carried out to evaluate its accuracy and usability.

Usability and shoulder surfing vulnerability of pattern passwords on mobile devices using camouflage patterns

With the revolution of smart devices that have become the basis of our daily lives, the majority of users rely on them to save their personal and sensitive information. As a result, users are increasingly interested in authentication processes, which is a challenge for designers to provide a secure and usable authentication process. The pattern password is one of the most selected authentication methods, since the recent development in alternative authentication interfaces for smart phones, tablets and touch screens laptops. Although drawing a pattern seems easier than typing a password, it has a major security drawback which is the shoulder-surfing attack. Therefore, this paper proposes a shoulder-surfing resistance approach for mobile devices using Camouflage Patterns method which allows choosing a very short password, while insuring that the password remains hidden amongst a large number of nodes draws. Based on this approach, three techniques are introduced and implemented using an Android platform. An experimental study is conducted for evaluating the security and usability aspects. The results showed that the proposed approach is reasonably resistant against shoulder-surfing attacks and usable for users. Accordingly, this approach is recommended for designers in order to provide very simple and yet very complicated passwords, to be observed by the attacker, at the same time.

An Explainable Password Strength Meter Addon via Textual Pattern Recognition

Textual passwords are still dominating the authentication of remote file sharing and website logins, although researchers recently showed several vulnerabilities about this authentication mechanism. When a user creates or changes a password, a website usually leverages a password strength meter (PSM for short) to show the strength of the password. When the password is evaluated as a weak one, the user may replace the password with a stronger or securer one. However, the user is usually confused when the password, especially a frequently used password, is shown as a weak one. We argue that an explainable password strength meter addon, which could show the reasons of weak, may help users to more effectively create a secure password. Unfortunately, we find few sites in Alexa global top 100 showing these details. Motivated to help users with an explainable PSM, this paper proposes an addon to PSMs providing feedbacks in the form of pattern passwords explaining why a password is weak. This PSM addon can detect twelve types of patterns, which cover a very large proportion among 70 million of leaked real passwords from high-profile websites. According to our evaluation and user study, our PSM addon, which leverages textual pattern passwords, can effectively detect these popular patterns and effectively help users create securer passwords.

Empirical study on lexical sentiment in passwords from Chinese websites

Passwords are especially ubiquitous in authentication systems. Although a lot of research has concentrated on the analysis of passwords, statistical characteristics are limited to explicit properties such as string length, the use of numeric characters in passwords. We explore the implicit properties of lexical sentiment in passwords by utilizing Natural Language Processing technology. Firstly, we construct several dictionaries, such as frequently used words, General Inquirer polarities, extended Ekman sentiment words. Then, an algorithm to split passwords into meaningful units is designed. Finally, statistical characteristics in lexical sentiment are discovered from three large-scale password sets leaked from the Internet websites. The results show that the occurrence probability of sentiment words is higher than that of several known patterns, such as [country], [number][female name]. With consideration of sentiment polarity, we find that people tend to use positive words in passwords. The percentage of positive sentiment is greater than that of negative words. Further research reveals that the joy type of sentiment is more popular in passwords than other kinds of sentiments, such as surprise and sadness. The discoveries suggest that the lexical sentiment, especially, positive and joy type can be utilized as a component in password patterns to measure password strength.

Multilevel authentication scheme for security critical networks

The global use of smart electronic devices has given rise to new security and privacy concerns. The attacker can launch any security attacks by using a person's Smartphone which can threaten the security of that person and other network users. Several security mechanisms were designed with the goal of secure authentication of the user, nonstop and indirectly by using sensors like accelerometer, magnetometer, and orientation sensor, face capture with gyroscope or by password pattern, other biometric authentication methods and give alerts whenever required. In this paper, we introduce an explicit and implicit authentication approach that secures not only smart phones but can secure other electronic devices that needs greater level of safety from attackers. User authorization is an important security measure for protecting the information stored on any other electronic device, as these devices have a high risk of theft or unauthorized access. In this paper we provide multiple security checks in three steps to form a strong authentication and authorization framework for electronic devices other than smart phones. The three level authentication method used is involves password, a biometric authentication method and final security check using accelerometer.

An XML transformed method to improve effectiveness of graphical password authentication

Graphical passwords are already examined as the reliable authentication scheme over the textual passwords. These passwords promise the better robustness and memorability. Various available applications use the image and graphical passwords based authentication systems. But, such authentication systems suffer from the problem of managing pictorial or image data. To map the user input image or graphical password over the larger database, slow down the authentication process. In this present work, XML based schema is proposed to represent the graphical image. As a password image with the graphical pattern is loaded by the user, the server processed the pattern and verifies it for valid pattern based on stroke length and drift. Various forms of graphical patterns are obtained on input graphical pattern by applying the numerous transformations. The extracted pixel values from these practices are kept in an XML pattern DB. Then the server also updated the pattern bits in input image using LSB steganography approach and returns it back to the user as password image. Each time, user input the password image, the password pattern extraction is performed, and mapping is done on XML pattern DB. The implementation of the presented model is done as Mobile and Desktop application. The comparative performance evaluation signifies that the method is more effective than other image password mappers. As the complete information is extracted from the query password pattern image, the 100% accuracy in password mapping is obtained. The applied qualitative measures also verify that the proposed model has improved the reliability and robustness against various aspects.

Threats of Password Pattern Leakage Using Smartwatch Motion Recognition Sensors

Thanks to the development of Internet of Things (IoT) technologies, wearable markets have been growing rapidly. Smartwatches can be said to be the most representative product in wearable markets, and involve various hardware technologies in order to overcome the limitations of small hardware. Motion recognition sensors are a representative example of those hardware technologies. However, smartwatches and motion recognition sensors that can be worn by users may pose security threats of password pattern leakage. In the present paper, passwords are inferred through experiments to obtain password patterns inputted by users using motion recognition sensors, and verification of the results and the accuracy of the results is shown.

Password Cracking Detection System with Honeyword

Honeywords are the decoy words also known as potential password for a user which, when an attacker enters in the system, it is detected by the honeychecker. Honeyword is a technique that can be successfully used as a guard strategy which can be utilized against stolen secret key records. This technique is honed by putting bogus patterns of passwords inside the record that consist of passwords of authentication server to deceive adversary. Honeywords resemble ordinary, user-selected passwords. Various different password patterns make it troublesome for the attacker that steal a honeyword-laced password file to recognize the true user password and honeyword. (?Honey? is an old term for decoy resources in computing environments). In existing system honeywords (decoy passwords) are used to detect malicious attempter against hashed password database. While considering every single accessible record, the legitimate passwords are stored along with various patterns and different combinations of honeywords in order sense impersonation. While considering runtime scenario, a cyber-attacker hacked the file consisting of hashed passwords, but the attacker cannot make out whether the password that is available is authentic password or the honeyword any specific account. If the attacker tries to enter the dummy (honeyword) credentials, then an alarm will be triggered and that will notify the administrator regarding password file breach. Considering the present scenario of the expenses on the storage requirement for expanding the capacity prerequisite by ample amount, this technique is easy to adopt and implement efficiently to encounter the issues of password file disclosure events. The aim of this research is to study honeyword generation system and techniques and compare the sub tasks using the literatures published in those areas finding out the research gaps in them and to analyses them to make password more secure using security hybrid generation method using triple hashing technique as perfectly flat honeyword gene ration method. The second aim is to make honeywords more realistic to trap adversary easily.

Dynamic salt generation for mobile data security using elliptic curves against precomputation attacks

Pattern lock is a mechanism that most of the people set to their Android smart phones. As the built-in pattern lock system adds an extra layer of protection and is one of the innovative unlock methods supported by Android, a fair quantity of study has been done about its (in)security. Pattern locks are not difficult to crack and are vulnerable to precomputation attacks such as brute forcing, dictionaries and rainbow tables. Older versions of Android produce SHA-1 signatures for authentication process which are not salted hashes. However, the newer versions of Android pattern locks utilise scrypt hash function that generates random salt value which needs to be stored in the database to withstand such attacks. But for pattern passwords attaching a salt value is still found not to be enough and susceptible to brute force. This research, therefore, proposes a method where it helps to produce and append a salt value to a password dynamically by representing the pattern using points of an elliptic curve. After the implementation and analysis, the results show this method exhibits strict avalanche criterion and passwords will become more tolerant to brute forcing, and other precomputation attacks which makes it more difficult to compromise.

디지털 홀로그래피를 이용한 one-time pattern 상호 인증 방법

본 논문은 새로운 광학적 일회용 패턴암호 상호 인증 방법을 제안한다. 이 방법은 2-단계 위상천이 디지털 홀로그래피 기법을 사용하여 이중 인증을 제공하고, 광학적 일회용 패턴암호를 상호 양방향으로 시도-응답 악수 기법을 구현하여 양방향 인증을 수행한다. 클라이언트와 서버는 상호 인증시 일회용 패턴암호를 무작위 수로 선택하여 오직 한번만 사용하고 이를 암호화하여 전송하기 때문에, 되풀이 공격이나 중간자 공격과 같은 암호공격으로부터 암호시스템을 보호하고 보안수준을 한층 더 높일 수 있다. A new optical one-time pattern password(OTPT) mutual authentication method is proposed, which presents a two-factor authentication by 2-step phase-shifting digital holography and performs a two-way authentication by a challenge-response handshake of the optical OTPT in both directions. Because a client and a server use OTPT once as a random number and encrypt it for mutual authentication, it protects against a replay or a man-in-the middle attack and results in higher security level.

Enhancing Authentication Schemes for Multi-Level Graphical Password in Cloud Environment

The graphical password patterns are in the rising trend in world with the abundance of the touch screen devices. A variety of touch screen devices are present for the users such as mobile phones, tables, touch-enabled laptops, touchenabled notebooks, etc. The graphical password has evolved with the invention of the touch-screen devices. The popular graphical schemes known as Pass-Go Pattern, Pass-point pattern and other similar schemes has been studied for the development of the new graphical password scheme. The existing models based upon pass-go and pass-point model stays as the basic model for our research for the development of the effective and secure graphical password scheme. It becomes difficult to input the alphanumeric passwords on the touch screens. The alphanumeric input lacks the high order accuracy as well as requires more focus to input the password. Most of the popular schemes have used the 3x3, 3x4 or 4x3 point-grid method for prompting the patterns to the users. The clue-point method is another popular method to display the graphical grid for the password input. In the proposed graphical model, graphical authentication model based upon the images has been aimed at to resolve the issues persisting in the existing models. In this model, the shuffling pattern based method has been used for the mitigation of the shoulder surfing attacks. The shuffling pattern scheme changes the primary display for password input every-time, which also restructure the input grid to overcome the threat caused by the shoulder surfing attacks.The proposed model has been designed to offer the robust graphical password scheme with the face images randomly collected by the users. The random point module for the visualization of the password input module plays the key role in the proposed graphical password scheme. The proposed model is a circular point model where the points are placed on the circle and the images are drawn on the given points. The user has to input the graphical pattern by joining the images with each other in the certain sequence. The proposed model requires less focus and highly accurate and easy to use. The experimental results have been evaluated in the factors associated with the study of the usability, memorabiltiy and difficulty in password creation. The proposed model has been compared against the existing models on the basis of the latter factors, where the proposed model has outperformed the existing models.

Multi-Factor Graphical Password for Cloud Interface Authentication Security

As the trend of mobile devices is on the rise, every kind of internet application is being easily accessible locally using mobile apps. The proposed technique will be using onelevel double-trap image based authentication for the login protection in cloud platforms on mobile devices. The onelevel authentication scheme consists of various small images, which are made of single numerical or alphabetical characters each, in 3x3 point grid formation. The second level password is a 9 clue-points grid based password scheme for pattern passwords. The pattern password input grid is in the static arrangement and does not change at any point of time. The traditional 9 cluepoint scheme will additionally allow the overlapping patterns, hence they are prone to the shoulder surfing attacks, whereas the proposed scheme is based on shuffling geometrical shape and the overlapping password pattern to mitigate the threat of shoulder surfing attacks.

Cracking More Password Hashes With Patterns

It is a common mistake of application developers to store user passwords within databases as plaintext or only as their unsalted hash values. Many real-life successful hacking attempts that enabled attackers to get unauthorized access to sensitive database entries including user passwords have been experienced in the past. Seizing password hashes, attackers perform brute-force, dictionary, or rainbow-table attacks to reveal plaintext passwords from their hashes. Dictionary attacks are very fast for cracking hashes but their success rate is not sufficient. In this paper, we propose a novel method for improving dictionary attacks. Our method exploits several password patterns that are commonly preferred by users when trying to choose a complex and strong password. In order to analyze and show success rates of our developed method, we performed cracking tests on real-life leaked password hashes using both a traditional dictionary and our pattern-based dictionary. We observed that our pattern-based method is superior for cracking password hashes.