Preventing Shoulder-Surfing Attack with the Concept of Concealing the Password Objects’ Information

In this paper, a picture-based password scheme that uses the concept of concealing information about the password images as much as possible is proposed. This scheme has two phases in the proposed method: Registration Phase and Authentication Phase. During the Registration Phase, users are required to select multiple images as his or her password. Users are also required to remember the sequence in which the password images were selected. During the password selection process, an image can only be used once. Duplication of images in the password selection is not allowed because it decreases the randomness of the proposed system. During the Authentication Phase, a user is required to identify the correct “target” images within a grid of N x N images, where N is the grid size. The pictures shown in the grid are randomly shuffled. The users are required to click on the final “target” picture in the grid with the aid of the sequence of the registered password pictures. In order to log in, the user has to mentally go through a series of steps. For each step, there will be a starting picture, a cued picture, and a target picture, denoted as P_start, P_cued, and P_target, respectively. Initially, the starting picture and the cued picture can be determined using the first and second password pictures (registered by the user during the Registration Phase), respectively. From both the starting and cued pictures, the user has to identify the first “target” picture using the proposed algorithm. The first step is completed once the first “target” picture is determined. In the next step, the user has to find the next “target” picture with the aid of the current starting and cued pictures. In this step, the first “target” picture is used as the current starting picture and the current cued picture is obtained from the next registered password picture (third password picture). The same algorithm is used to determine the next “target” picture. This process is repeated until the last step when the final “target” picture is obtained. The user is required to click on the final “target” picture and a challenge round is considered complete. The number of steps in the Authentication Phase is always one less than the number of password images selected. The number of challenge rounds is arbitrary and can be increased to suit the level of security required, thus improving the password space, though the amount of mental work expended by the user increases accordingly.

http://www.hindawi.com/journals/tswj/2014/838623/