Recognition-based Graphical Authentication Research Articles

A3C: An Image-Association-Based Computing Device Authentication Framework for People with Upper Extremity Impairments

Current computing device authentication often presents accessibility barriers for people with upper extremity impairments (UEI). In this paper, we present a framework called Accessible image-Association-based Authentication for Computing-devices (A3C) , a novel recognition-based graphical authentication framework specifically designed for people with UEI to authenticate to their computing devices. A3C requires users to provide a set of primary images that the user knows that are recognizable to them and subsequently associate each primary image with a secondary image. To evaluate the efficacy of the A3C framework, we instantiated the framework by implementing a version of A3C called A3C-FA , which uses images of faces of people the user knows as the primary image and animal images as the secondary image. We then performed three studies to evaluate A3C-FA: a shoulder-surfing attack study ( N=319 ), a close-adversary attack study ( N=268 ), and a usability study with people with UEI ( N=14 ). We found that A3C was robust against both shoulder-surfing and close-adversary attacks. We also performed a detailed study to evaluate the accessibility of A3C-FA. Our participants reported that A3C-FA was more usable and more secure than the authentication approaches with which they were familiar. Based on these findings, we suggest four areas of future research to further improve the design of A3C framework.

A Human-Cognitive Perspective of Users’ Password Choices in Recognition-Based Graphical Authentication

ABSTRACTGraphical password composition is an important part of graphical user authentication which affects the strength of the chosen password. Considering that graphical authentication is associated with visual search, perception, and information retrieval, in this paper we report on an eye-tracking study (N = 109) that aimed to investigate the effects of users’ cognitive styles toward the strength of the created passwords and shed light into whether and how the visual strategy of the users during graphical password composition is associated with the passwords’ strength. For doing so, we adopted Witkin’s Field Dependence-Independence theory, which underpins individual differences in visual information and cognitive processing, as graphical password composition tasks are associated with visual search. The analysis revealed that users with different cognitive processing characteristics followed different patterns of visual behavior during password composition which affected the strength of the created passwords. The findings underpin the need of considering human-cognitive characteristics as a design factor in graphical password schemes. The paper concludes by discussing implications for improving recognition-based graphical passwords through adaptation and personalization techniques based on individual cognitive characteristics.

RSVP a temporal method for graphical authentication

We present a Rapid, Serial, Visual Presentation method (RSVP) for recognition-based graphical authentication. It presents a stream of rapid, degraded images, which makes the object recognition proc...

Why That Picture? Discovering Password Properties in Recognition-Based Graphical Authentication

ABSTRACTNumerous graphical authentication ideas have been proposed on how to address the security and usability of text-based passwords. However, it remains unclear how users approach graphical password selection and the inherent personal bias when selecting images. This study investigates user choices in password selection for recognition-based graphical authentication. Our analysis is based on a total of 302 participants continuously using a graphical authentication system during a 6-week long study. The results show pronounced preference effects for image properties such as color, shape, and category. Additionally, there is a significant difference between genders in the selected images based on the same properties.

Faces and Pictures: Understanding age differences in two types of graphical authentications

Recall of knowledge-based authentication codes such as passwords and PINs can be problematic, particularly for older adults given the known memory decline associated with ageing. We explored the extent to which recognition-based Graphical Authentication Systems were effective alternatives to PINs and passwords in a study in which users were asked to commit several different codes to memory and recall them at different time periods. Populations of younger and older adults were given face-based and picture-based authentication codes to remember over the course of three weeks. Results show a pronounced age effect, with younger participants outperforming older participants. Older participants fared better with the face-based system over the picture-based system while younger participants exhibited the opposite effect. A significant performance drop was observed for older participants over time, as additional codes were introduced.

On designing usable and secure recognition-based graphical authentication mechanisms

In this article we present the development of a new, web-based, graphical authentication mechanism called ImagePass. The authentication mechanism introduces a novel feature based on one-time passwords that increases the security of the system without compromising its usability. Regarding usability, we explore the users’ perception of recognition-based, graphical authentication mechanisms in a web environment. Specifically, we investigate whether the memorability of recognition-based authentication keys is influenced by image content. We also examine how the frequency of use affects the usability of the system and whether user training via mnemonic instructions improves the graphical password recognition rate. The design and development process of the proposed system began with a study that assessed how the users remember abstract, face or single-object images, and showed that single-object images have a higher memorability rate. We then proceeded with the design and development of a recognition-based graphical authentication mechanism, ImagePass, which uses single-objects as the image content and follows usable security guidelines. To conclude the research, in a follow-up study we evaluated the performance of 151 participants under different conditions. We discovered that the frequency of use had a great impact on users’ performance, while the users’ gender had a limited task-specific effect. In contrast, user training through mnemonic instructions showed no differences in the users’ authentication metrics. However, a post-study, focus-group analysis revealed that these instructions greatly influenced the users’ perception for memorability and the usability of the graphical authentication. In general, the results of these studies suggest that single-object graphical authentication can be a complementary replacement for traditional passwords, especially in ubiquitous environments and mobile devices.

My password is here! An investigation into visuo-spatial authentication mechanisms

Passwords are the almost universal authentication mechanism, even though they are basically flawed and cause problems for users due to poor memorability. Graphical methods of authentication have recently excited some interest but little is known about their actual efficacy. There are basically two types of graphical authentication mechanisms: recognition-based and location-based—also called visuo-spatial mechanisms. Whereas some kinds of recognition-based graphical authentication mechanisms have been evaluated by various researchers, there is still a need to investigate location-based graphical authentication mechanisms in a more rigorous fashion to determine whether they could be a viable alternative to traditional passwords for web usage. This paper discusses graphical authentication mechanisms in general and reports on the evaluation of one particular visuo-spatial mechanism, aimed at augmenting the password paradigm by providing a way to record passwords securely. Results and findings are presented, and conclusions drawn, some of which can also be applied to other types of visuo-spatial mechanisms. We also propose a set of metrics which can be used to measure the quality of web authentication mechanisms and apply these to a range of existing authentication mechanisms.