Password Scheme Research Articles

An exploration of graphical password authentication for children

Abstract In this paper, we explore graphical passwords as a child-friendly alternative for user authentication. We evaluate the usability of three variants of the PassTiles graphical password scheme for children, and explore the similarities and differences in performance and preferences between children and adults while using these schemes. Children were most successful at recalling passwords containing images of distinct objects. Both children and adults prefer graphical passwords to their existing schemes, but password memorization strategies differ considerably between the two groups. Based on our findings, we provide recommendations for designing more child-friendly authentication schemes.

TCpC: a graphical password scheme ensuring authentication for IoT resources

In last few years, information world has come across one of the most appealing paradigms, namely Internet-of-Things (IoT). Both the industry as well as the academia is fascinated by the open issues and research challenges of Internet-of-Things. The enormity in the development, expansion, and advantages of the paradigm is unbelievable, and this results in the transition of the information world to this paradigm. At the same time, it raises the security concerns along with many other open issues towards the paradigm. This paper specifically focuses on the confidentiality component out of the three components of security triad, namely confidentiality, integrity and availability. Although researchers have high interest towards all the three components, but the questions posed by many researchers, academicians and end users raise major issues over ‘confidentiality’. Confidentiality is all about guaranteeing the authentic access to a piece of information or a service or even a resource, to a particular individual or computing device. The resource in question may be one of the resources of an IoT system. This can be achieved by deploying some authentication techniques. Here we discuss various types of authentication techniques, purposely putting our emphasis on one of the well-known authentication technique, viz. passwords. This work reviews the existing techniques, their drawbacks and claimed advantages of the upcoming password techniques. It also surveys some of the supportive methods for the naive users of password techniques. This paper aims at classifying, comparing and encapsulating the problems, demanded solutions and suggestions from relevant published technical and review articles in the field of authentication. This paper particularly highlights graphical password schemes. This proposes a naive graphical password scheme to assure the authentic access of IoT resources, namely TCpC. At the end we have mentioned the advantages of TCpC over other authentication schemes. We have also compared and analyzed the different proposed password schemes with our technique.

Divide and Conquer Approach for Solving Security and Usability Conflict in User Authentication

Knowledge based authentication schemes are divided into textual password schemes and graphical password schemes. Textual password schemes are easy to use but have well known security issues, such as weak against online security attacks. Graphical password schemes are generally weak against shoulder surfing attacks. Usability is another issue with most of the graphical password schemes. For improving security of knowledge-based authentication schemes complex password entry procedures are used, which improve security but weakens useability of the authentication schemes. In order to resolve this security and usability conflict, a user authentication scheme is proposed, which contains one registration and two login screens called easy and secure login screens. Easy login screen provides easy and quick way of authentication while secure login screen is resilient to different online security attacks. A user has to decide based upon the authentication environment, which login screen to be used for authentication. For secure environment, where chances of security attacks are less easy login screen is recommended. For insecure environments where chances of security attacks are high, secure login screen is recommended for authentication. In the proposed scheme, image based passwords can also be set along with alphanumeric passwords. Results suggest that proposed scheme improves security against offline and online attacks.

Enhanced Textual Password Scheme for Better Security and Memorability

Traditional textual password scheme provides a large number of password combinations but users generally use a small portion of available password space. Complex textual passwords are difficult to remember, therefore most users choose passwords with small length and contain dictionary words. Due to the use of small password length and dictionary words, textual passwords become easy to crack through offline guessability attacks. Traditional textual passwords scheme is also weak against keystroke logger attacks because alphanumeric characters are directly inserted into the password field. In this paper, enhancements are proposed in the registration and login screen of the traditional textual password scheme for improving security against offline guessability attacks and keystroke logger attacks. The proposed registration screen also improve memorability of traditional textual passwords through visual cues or pattern-based approach. In the proposed login screen, passwords are indirectly inserted into the password field, to resist keystroke logger attacks. A comparative analysis between the passwords created in traditional and proposed pattern-based approach is presented. The testing results show that users create strong and high entropy passwords in the proposed pattern-based approach as compared to the traditional textual passwords approach.

CMAPS: A Chess-Based Multi-Facet Password Scheme for Mobile Devices

It has long been recognized, by both security researchers and human–computer interaction researchers, that no silver bullet for authentication exists to achieve security , usability , and memorability . Aiming to achieve the goals, we propose a Multi-fAcet Password Scheme (MAPS) for mobile authentication. MAPS fuses information from multiple facets to form a password, allowing MAPS to enlarge the password space and improve memorability by reducing memory interference, which impairs memory performance according to psychology interference theory. The information fusion in MAPS can increase usability, as fewer input gestures are required for passwords of the same security strength. Based on the idea of MAPS, we implement a Chess-based MAPS (CMAPS) for Android systems. Only two and six gestures are required for CMAPS to generate passwords with better security strength than 4-digit PINs and 8-character alphanumeric passwords, respectively. Our user studies show that CMAPS can achieve high recall rates while exceeding the security strength of standard 8-character alphanumeric passwords used for secure applications.

Pixel Value Graphical Password Scheme: Fake <i>Passpix</i> Attempt on Hexadecimal Password Style

Early design of graphical password scheme solved the strong alphanumeric password deficiencies in term of hard to memorized, but they was exposed to password shoulder surfing and complicated to produced even by the legitimate users. Motivated to solve the problems, pixel value graphical password scheme was developed in 2012 where it require user to load any their desired digital image as their password. The term <i>Passpix</i> is referring to the pixel value that extracted from the loaded image file derived from the words password pixel. Pixel value in the form of RGB color strength could be representing as 3-octets 8-bits color code (0 to 255) or Hexadecimal code (000000 to FFFFFF) produced 16,777,216 combinations. Pixel value graphical password increases the password strength by implementing two-dimensional 8 by 8 grid extraction that increases the password strength to 1,073,741,824 combinations. It would result the password could be long or super long. Currently, pixel value graphical password scheme using the 8-bits color code as the pixel value and password that stored into database which could produce up to 576 characters. This would be require more storage capacity to store the password that brings into a suggestion to extracting the pixel value using hexadecimal code which produced 384 characters only. Further study on that idea it is found that the number of password characters did not brings a significant impact on-disk data size and it is easy information to construct a fake <i>Passpix</i> which is discussed further in this paper. This paper is organized into 5 sections where the background and concept of pixel value graphical password scheme is introduced in section 1. Section 2 of this paper is describing the password style of pixel value graphical password. The fake <i>Passpix</i> reconstruction is briefly explained in section 3 and section 4 is discussed further about the fake <i>Passpix</i> findings. The conclusion of this study can be found in section 5 and at the end of this paper, there are list of several references used in this study. Hopefully this paper will brings major contribution for safer pixel value graphical password scheme.

Graphical password scheme to diminish shoulder surfing

Many authentication schemes are known to us but none of them are completely secure. Textual password is the most common technique used by majority of the people in the industry. But Textual passwords are vulnerable to dictionary attacks, keyloggers, brute-force attacks, even guessing may work out sometimes. Alternative authentication schemes have been proposed to overcome this problem, some of them are Biometric authentication, retina based authentication, graphical password scheme ETC., Authentication Schemes such as biometric and retina scans are too costly, so they are not always preferred. Not every graphical authentication is secure and efficient. In this paper, an authentication scheme with a combination of text and colour is proposed. This allows the user to log-in to the framework a little more secure.

Someone in Your Contact List: Cued Recall-Based Textual Passwords

Textual passwords remain the most commonly employed user authentication mechanism, and potentially will continue to be so for years to come. Despite the well-known security and usability issues concerning textual passwords, none of the numerous proposed authentication alternatives appear to have achieved a sufficient level of adoption to dominate in the foreseeable future. Password hints, consisting of a user generated text saved at the account setup stage, are employed in several authentication systems to help users to recall forgotten passwords. However, users are often unable to create hints that jog the memory without revealing too much information regarding the passwords themselves. We propose a rethink of password hints by introducing SỲNTHIMA , a novel cued recall-based textual password method that reveals no information regarding the password, requires no modifications to authentication servers, and requires no additional setup or registration steps. SỲNTHIMA makes use of users’ contact lists, so that mapped password hints extracted from a user’s contacts are automatically generated while the user is typing the password. We create formal models for relevant aspects of the password hint mechanism, define its threat model, and analyze the security and usability of SỲNTHIMA . We also present the results of an in-lab user study of SỲNTHIMA on 30 participants to evaluate its effectiveness and usability. The results demonstrate that SỲNTHIMA minimizes the number of incorrect login attempts and improves long-term password recall, with acceptable login times and positive user feedback. We summarize the lessons learned from the user study, with the hope of provoking further insights regarding the design of effective cued recall-based textual password schemes.

A Theoretical Framework for Password Security against Offline Guessability Attacks

Objectives: Security of textual passwords is increased against offline guessability attacks by using different encryption methods. However, even after encryption textual passwords may be guessed through brute-force or dictionary attacks. Method: In this paper, a theoretical framework is developed which provides guidelines for improving password security against offline guessability attacks such as brute force and dictionary attacks. In the proposed framework different password security layers are defined which convert a password into a form which is very difficult to crack through offline guessability attacks. The framework layers are implemented at application and database level. Findings: In the proposed framework a short and easy to remember password string is converted into a long and random string which does not provide any hint of original password. However, it is important that the methodology or logic used for implementing the framework layers should be hidden from the attackers because the layers’ methodology may provide a clue for password cracking. Layers of the proposed framework can be implemented with different logics, which are helpful in hiding the implementation details of the layers. Application/Improvements: Proposed framework is not only helpful for improving security of traditional textual password scheme but it can also improve the security for graphical password schemes against offline guessability attacks. Keywords: Authentication, Guessability Attacks, Privacy, Password Security, Textual Passwords

The Effect of Baroque Music on the Passpoints Graphical Password

Graphical passwords have been demonstrated to be the possible alternatives to traditional alphanumeric passwords. However, they still tend to follow predictable patterns that are easier to attack. The crux of the problem is users’ memory limitations. Users are the weakest link in password authentication mechanism. It shows that baroque music has positive effects on human memorizing and learning. We introduce baroque music to the PassPoints graphical password scheme and conduct a laboratory study in this paper. Results shown that there is no statistic difference between the music group and the control group without music in shortterm recall experiments, both had high recall success rates. But in long-term recall, the music group performed signifi- cantly better. We also found that the music group tended to set significantly more complicated passwords, which are usually more resistant to dictionary and other guess attacks. But compared with the control group, the music group took more time to log in both in short-term and long-term tests. Besides, it appears that background music does not work in terms of hotspots.

Enhancement of Password Authentication System Using Recognition based Graphical password for web Application

Authentication is most important topic in information security. Currently web applications are using text based password for authentication, but text based passwords are suffered to security and usability issues. Text passwords are vulnerable to spyware, brute force and dictionary attacks. Graphical based password is proposed to overcome vulnerabilities of text based passwords. Graphical based password authentication technique use images as a password. Psychological studies says that human mind remember images better than text. Graphical passwords are more secure than text. In this paper, we will propose recognition based graphical password scheme to provide security against spyware and shoulder surfing attacks as well as this scheme provide the two factor authentication in order to resist unauthorized users. In this scheme, at time of sign up user has to choose images from set of images given by server and at time of signing user has to recognize that images from set of images for authentication. We are using random character set generation for each image to resist shoulder surfing as well as spyware attacks. We also fetch user’s password images randomly from database to resist spyware attack.

USER AUTHENTICATION THROUGH CUED CLICK POINTS BASED GRAPHICAL PASSWORD

User authentication is a fundamental component in most computer security context. In recent years, computer and network security has been formulated as a technical problem. A key area in security research is authentication which is the determination of whether a user should be allowed access to a given system or resource. In this respect, Authentication is a process by which a system verifies the identity of a user. Authentication may also be generalized by saying that “to authenticate” means “to authorize”. Users tend to pick passwords that can be easily guessed, on the other hand, if a password is hard to guess, then it is often hard to remember. To address this problem some researchers have developed authentication methods that use pictures as passwords, known as graphical passwords.Graphical passwords are a proposed alternative to text passwords that have been shown to have good usability and security properties that use images for login, and leverage the picture superiority effect for good usability and memorability. Categories of graphical passwords have been distinguished on the basis of different kinds of memory retrieval (recall, cued-recall, and recognition). Though there are several kinds of graphical password, But We have choose to implement the cued click based due to efficient and more secured, Cued click points is a click-based graphical password scheme, Users click on one point per image for a sequence of images. The next image is based on the previous clickpoint. Performance was very good in terms of speed, accuracy, and number of errors. Graphical passwords may offer better security than text-based passwords because many people, in an attempt to memorize text-based passwords, use plain words rather than the recommended jumble of characters.

A Text based Authentication Scheme for Improving Security of Textual Passwords

User authentication through textual passwords is very common in computer systems due to its ease of use. However textual passwords are vulnerable to different kinds of security attacks, such as spyware and dictionary attacks. In order to overcome the deficiencies of textual password scheme, many graphical password schemes have been proposed. The proposed schemes could not fully replace textual passwords, due to usability and security issues. In this paper a text based user authentication scheme is proposed which improves the security of textual password scheme by modifying the password input method and adding a password transformation layer. In the proposed scheme alphanumeric password characters are represented by random decimal numbers which resist online security attacks such as shoulder surfing and key logger attacks. In the registration process password string is converted into a completely new string of symbols or characters before encryption. This strategy improves password security against offline attacks such as brute-force and dictionary attacks. In the proposed scheme passwords consist of alphanumeric characters therefore users are not required to remember any new kind of passwords such as used in graphical authentication. Hence password memorability burden has been minimized. However mean authentication time of the proposed scheme is higher than the textual password scheme due to the security measures taken for the online attacks.

Security and Verification of Server Data Using Frequent Itemset Mining in Ecommerce

Frequent itemsets refer to a set of data values (e.g., product items) whose number of co-occurrences exceeds a given threshold. The challenge is that the design of proofs and verification objects has to be customized for different data mining algorithms. Intended method will implement a basic idea of completeness verification and authentication approach in which the client will uses a set of frequent item sets as the evidence, and checks whether the server has missed any frequent item set as evidence in its returned result. It will help client detect untrusted server and system will become much more efficiency by reducing time. In authentication process CaRP is both a captcha and a graphical password scheme. CaRP addresses a number of security problems altogether, such as online guessing attacks, relay attacks, and, if combined with dual-view technologies, shoulder-surfing attacks.

Authentication Scheme for Session Passwords Using Color and Image

Abstract Graphical passwords are believed to be more secure than traditional textual passwords, but the authentications are usually complex and boring for users. Furthermore, most of the existing graphical password schemes are vulnerable to spyware and shoulder surfing. A novel graphical password scheme ColorLogin is proposed in this paper. ColorLogin is implemented in an interesting game way to weaken the boring feelings of the authentication. ColorLogin uses background color, a method not previously considered, to decrease login time greatly. Multiple colors are used to confuse the peepers, while not burdening the legitimate users. Meanwhile, the scheme is resistant to shoulder surfing and intersection attack to a certain extent. Experiments illustrate the effectiveness of ColorLogin.

New Graphic Password Scheme Containing Questions-Background-Pattern and Implementation

Security of authentication is needed to be provided superlatively to secure users’ personal and exchange information since online information exchange systems have been developed according to internet speed. Therefore, the aim of this paper is to develop existing graphical password scheme based on one's memory, create and implement a new graphical password scheme that composed of three layer verification. We programmed our scheme in order to prove its superiority comparing with existing schemes. While we conducted survey on user by accessing participant to our system lied in participants’ local network and we analyzed in accordance with the average length of their created password and statistical significant of entropy bit. From the survey results of total participants, we find that our scheme has statistical significant, furthermore it was proved that it can secure from a variety of attacks due to its high entropy.

VAP code: A secure graphical password for smart devices

In parallel to the increasing purchase rate of the smart devices, attacks on these devices are also increasing in an alarming rate. To prevent these attacks, many password-based authentication schemes are proposed. Among them, graphical password schemes are preferred on these devices due to their limited screen size and a lack of full sized keyboard. Again, existing graphical password schemes are susceptible to various attacks, among which shoulder surfing, smudge attack, and brute force attack are the most prominent. Hence, in this paper, we propose Vibration-And-Pattern (VAP) code, a new graphical password scheme that is resilient against these three major attacks. To evaluate the usability of our proposed scheme, a usability study has been conducted on 122 participants of various age groups from different demographics.

A cost-efficient one time password-based authentication in cloud environment using equal length cellular automata

Abstract One time password (OTP) scheme has been suggested as an efficient and simple solution for authentication in cloud computing. This paper investigates the nature of characteristics polynomials of Equal Length Cellular Automata (ELCA) and its application in OTP generation for authentication in cloud computing. In this work, primitive characteristics polynomial is identified as a crucial criterion for pseudo-randomness of ELCA cycles generated with linear rules. Novel algorithms are also designed for (i) cost effective generation of OTPs, (ii) flexible generation of equally populated OTP sets, and (iii) generation of controllable number of passwords in OTP sets. Application of linear rules in synthesis of OTPs ensures easy implementation using only modular arithmetic, which makes the proposed method truly cost efficient.

Evaluation of Recognition-Based Graphical Password Schemes in Terms of Usability and Security Attributes

&lt;p&gt;User Authentication is a critical component in information security. Several widely used mechanisms for security to protect services from illegal access include alphanumerical usernames passwords. However, there are several drawbacks attached in this method. For instance, the users themselves usually those passwords that are easy to guess. As difficult passwords are difficult to recall. A new alternative is the graphic-based password and there has been a growing trend in the use of such a password. The human psychology study reveals that humans find it easier to remember pictures as opposed to words. There are two main aspects to the graphical password scheme, namely security and usability. This study comprises of a comprehensive research in the current Recognition-Based graphical password schemes. The common usability attributes and possible attacks on the Recognition-Based graphical password are reviewed, identified and examined in detail. There are several previous surveys on the graphical passwords. The latest research review and summarize graphical password systems concisely and at the same time, analyze usability features for every design. However it was found that there is not a single method that has the most resounding usability attributes. Therefore, this research suggests a set of usability attributes that can be applied into a single Recognition-Based graphical password system. In addition, this study examines and compares success rates on login, login time and memorability of existing systems which are the usability measures most often reported in user studies of graphical passwords. Lastly, a comparison table is revealed to put forth the limitations and strengths of each approach in terms of security and usability.&lt;/p&gt;

Draw a Line on Your PDA to Authenticate

The trend toward a highly mobile workforce and the ubiquity of graphical interfaces (such as the stylus and touch-screen) has enabled the emergence of graphical authentications in Personal Digital Assistants (PDAs) [1]. However, most of the current graphical password schemes are vulnerable to shoulder-surfing [2,3], a known risk where an attacker can capture a password by direct observation or by recording the authentication session. Several approaches have been developed to deal with this problem, but they have significant usability drawbacks, usually in the time and effort to log in, making them less suitable for authentication [4, 8]. For example, it is time-consuming for users to log in CHC [4] and there are complex text memory requirements in scheme proposed by Hong [5]. With respect to the scheme proposed by Weinshall [6], not only is it intricate to log in, but also the main claim of resisting shoulder-surfing is proven false [7]. In this paper, we introduce a new graphical password scheme which provides a good resistance to shouldersurfing and preserves a desirable usability.