Recognition-based Graphical Passwords Research Articles

A Human-Cognitive Perspective of Users’ Password Choices in Recognition-Based Graphical Authentication

ABSTRACTGraphical password composition is an important part of graphical user authentication which affects the strength of the chosen password. Considering that graphical authentication is associated with visual search, perception, and information retrieval, in this paper we report on an eye-tracking study (N = 109) that aimed to investigate the effects of users’ cognitive styles toward the strength of the created passwords and shed light into whether and how the visual strategy of the users during graphical password composition is associated with the passwords’ strength. For doing so, we adopted Witkin’s Field Dependence-Independence theory, which underpins individual differences in visual information and cognitive processing, as graphical password composition tasks are associated with visual search. The analysis revealed that users with different cognitive processing characteristics followed different patterns of visual behavior during password composition which affected the strength of the created passwords. The findings underpin the need of considering human-cognitive characteristics as a design factor in graphical password schemes. The paper concludes by discussing implications for improving recognition-based graphical passwords through adaptation and personalization techniques based on individual cognitive characteristics.

A Graphical Authentication System Controlled by Eye Movement

Graphical password is a potential alternative to the traditional alphanumerical password due to its advantages of recognition and memory in the security system. Eye movement, a natural interaction modality, is a promising tool to replace the keyboard and the mouse in authentication. This paper proposes a graphical authentication system controlled by eye movement. In this keyboard-less authentication system, the user’s eye movements were recorded by eye-tracker as the control signal to generate recognition-based graphical passwords. The user test study has been conducted to verify the availability and effectiveness of this keyboard-less graphical authentication system. It’s also shown that the efficiency could be improved as the user getting familiar with this system.

Password Entry Times for Recognition-based Graphical Passwords

Graphical passwords offer a more memorable alternative to traditional, text-based passwords. Among current contenders, cued-recall based click-point or gesture centered authentication systems like Microsoft’s picture gesture authentication (PGA) have been commercially more successful than recognition based systems (e.g., PassFaces). One perceived drawback of graphical authentication systems in general and especially recognition based authentication is the assumption that graphical authentication is slower and thus less user-friendly than traditional password entry via keyboard. This paper addresses these concerns and demonstrates a lower limit for recognition-based password entry times achievable with sufficient practice. While slightly slower than traditional keyboard based passwords, the entry speed of often-used graphical passwords is shown to reach 10 bits/s in an optimized configuration, which is sufficient for everyday use (3-6s per authentication sequence @ 36 bits) and exceeds the reported speed of similarly secure text-based passwords on non-traditional devices using virtual keyboards.

Two Step Endorsement: Text Password and Graphical Password

Security-sensitive environments protect their resources against unauthorized access by enforcing access control mechanisms. Text based passwords are not secure enough for such applications. User authentication can be improved by using both text passwords and structured images. In order to offer sufficient security, require a number of rounds of verification, introducing usability issues. We suggest a hybrid user authentication approach combining text passwords, recognition-based graphical passwords, and a dual-step process, to provide increased security with fewer rounds than such graphical passwords alone. A variation of this dual-step authentication method, which we have implemented and deployed, is in use in the real world.