Abstract
Graphical password systems have received significant attention as one potential solution to the need for more usable authentication, but graphical passwords are often considered prone to shoulder-surfing attacks. In this paper, in order to build a balance between usability and security for authentication, we propose a new graphical password scheme by combining a specific verification grid with map slipping strategy. In the proposed scheme, a set of fixed grids are pregenerated on a map. During the registration process, the user is not only asked to select several points in sequence on the map to form a password route, but also required to choose one of the pregenerated grids as a specific verification grid for the subsequent authentication. The password route and the specific verification grid together form the complete graphical password. During the authentication process, the user needs to slip the map to let each point on the password route sequentially fit inside the specific verification grid which is already remembered by the user but difficult to be detected by the attackers. With the specific verification grid and the map slipping strategy, the proposed scheme can effectively defend against shoulder-surfing attacks. Meanwhile, the password points are represented as coordinates on the map; therefore, the proposed scheme has a negligible storage burden. The comparative experiments show that, using the proposed scheme, the success rate of shoulder-surfing defense can be increased by 37% to 56% with different grid sizes and password point numbers, and the usability of passwords can also be improved by 3% to 6%. Therefore, the proposed scheme can achieve good shoulder-surfing defense and reasonable usability simultaneously.
1. Introduction
In nowadays information age, the user’ data is facing an increasing risk of being attacked or stolen [1–5]. Identity authentication has become more and more important which can secure information systems by preventing unauthorized users from gaining access to the systems, so as to protect information security.
A plenty of methods have been proposed to perform authentication [2, 6–19]. Among them, the alphanumerical password authentication is the primary form, because this form is easy to implement. A secure password should be random and easy to remember at the same time. Unfortunately, a random alphanumerical password is usually not easy to remember. Therefore, the graphical password is introduced as an alternative to help users to memorize their password better, since it is much easier for humans to remember images than verbal representations [20].
Besides the advantages, the common problem with graphical passwords is that they are hardly resilient against shoulder-surfing attacks [21]. That means graphical passwords are not difficult to get by looking over the user’s shoulder, or with the aid of recording devices such as cameras.
In this paper, in order to get a balance between usability and security, we propose a verification grid and map slipping based graphical password (VGMSGP) scheme. In the proposed scheme, a set of fixed grids are pregenerated on a map. During the registration process, the user is not only asked to select several points in sequence on the map to form a password route, but also required to choose one of the pregenerated grids as a specific verification grid for the subsequent authentication. The password route and the specific verification grid together form the complete graphical password. During the authentication process, the user needs to slip the map to let each point on the password route sequentially fit inside the specific verification grid which is already remembered by the user but difficult to be detected by the attackers. With the specific verification grid and the map slipping strategy, the proposed VGMSGP scheme can effectively defend against shoulder-surfing attacks. Meanwhile, the password points are represented as coordinates on the map; therefore, the proposed scheme has a negligible storage burden. The following lists the main contributions of the proposed scheme.(1)Effective resistance against shoulder-surfing attacks: in the proposed VGMSGP scheme, the password consists of two components. One is the password route with some points on the map, and the other is the specific verification grid which is blended with the regular ones. To perform authentication, the users cannot, respectively, click the password points in an indefensible way; they have to slip the map to let each point on the password route sequentially fit inside the specific verification grid. Since the specific verification grid is blended with the regular grids, it is difficult to be detected by the attackers. Except that, the track of map slipping is not easy to capture neither. Therefore, the proposed VGMSGP scheme can achieve an effective resistance against shoulder-surfing attacks.(2)High usability of passwords: in the proposed VGMSGP scheme, during the registration process, the user needs to select several points on the map. Since the points are related with the locations on the map, and the locations are full of information, the points along with the password route are easy to remember. At the same time, the pregenerated grids are scaled well; it is also easy to remember the position of the specific verification grid. Therefore, the proposed VGMSGP scheme can achieve a high usability of passwords.(3)Less burden on the authentication server: in the proposed VGMSGP scheme, instead of storing a great amount of pictures on the server, we take advantage of Google Maps API to implement both the registration and the authentication. In this way, the server only needs to store the coordinates of the password points, which reduces the pressure of the system storage.
The rest of this paper is outlined as follows. Section 2 reports the related works. The proposed VGMSGP system is introduced in Section 3. The evaluation results and analysis are given in Section 4. Conclusions are drawn in Section 5.
2. Related Work
Fundamentally, graphical passwords can be categorized into three categories: recognition-based [22–28], redrawing-based [29–35], and reselection-based [36–44]. In recognition-based systems, the user needs to choose a number of images from a large portfolio of images to create a password for the first time. During the authentication process, the user must successfully identify the prior password images and distinguish them from other decoy images. In redrawing-based systems, the user needs to create or select a secret drawing when registering for the first time and then reproduces the same drawing on a grid or a blank canvas during the authentication stage. In reselection-based systems, the user creates the password by selecting several predefined objects on a single image or several images. For authentication, the user is demanded to reselect the same objects chosen by the user in the registration process.
2.1. Recognition-Based Graphical Password System
There are many graphical password authentication systems based on the recognition of different kinds of images or objects, such as describable abstract images [27], face photos [24], thumbnail pictures [23], and object icons [25, 26, 28, 35]. In some references [23, 24, 27], the user chooses several images from a database as the key images to register on an authentication server. In the login phase, users can identify his/her chosen images from a set of images displayed on a screen to perform authentication.
Wiedenback et al. [22] developed an object recognition-based graphical password authentication scheme to resist shoulder-surfing attacks. The user needs to recognize a set of preselected object icons displayed on the screen and then to click inside the convex hull region formed by connecting these pass-object icons.
Yu et al. [26] proposed an evolvable graphical password-based authentication mechanism, called as EvoPass, to resist shoulder-surfing attacks. In EvoPass, each user identifies object sketches from a set of preselected images, where the object sketches are generated by an edge extraction algorithm from the personal images or the images downloaded from webs. Their pass sketches are more secure than the pass images against shoulder-surfing attacks since it is hard to remember the pass sketches.
The recognition-based graphical password system is easy to use. However, the displaying area to display objects is usually small, and the amount of objects which can be displayed is limited then, which greatly reduces the password space and then might result in bad resistance to security attacks. Moreover, the authentication server has to store a large number of password pictures. Therefore, this method undoubtedly causes great storage load on the server.
2.2. Redrawing-Based Graphical Password System
As another authentication strategy, redrawing-based graphical password systems have been developed to expand the password space.
Jermyn et al. [29] proposed Draw-a-Secret (DAS) technique, in which each user is allowed to draw a unique password. In the registration phase, users draw a simple picture on grids. After that, the coordinates of the grids occupied by the picture are stored in the order they are drawn. During the registration process, the user needs to redraw the picture. During the authentication process, if the redrawing path goes through the correct grids in the correct order, users are authenticated successfully. Besides, some works [30, 31] studied the password space and stroke-count of the DAS technique and illustrated that the stroke-count plays an important role in the DAS password space.
To enhance the security of FinTech authentication against cybercriminals, Meng et al. [35] proposed an authentication system based on the map graphical password. In their method, the user will initialize a route on a world map as the credentials. When logging into the system, the user is required to redraw the route. This scheme achieved good performance in authentication accuracy and multiple password storage.
However, because the directly displayed password route is easy to be detected, the shoulder-surfing attacker can easily steal the user's password.
Basically, the redrawing-based method offers a large password space comparable to that of the recognition-based scheme. However, it still faces security issues. These redrawing-based passwords are still vulnerable to shoulder-surfing attacks.
2.3. Reselection-Based Graphical Password System
Different from redrawing-based graphical password systems, the reselection-based graphical password achieves higher password space and maintains usability through simple selection actions. Generally, three reselection-based graphical passwords have been popularly adopted: pass-points graphical passwords (PPGP) [37–40], cued click-points graphical passwords (CCPGP) [41, 42], and Google map-based graphical password (GMGP) [43, 44].
In the PPGP system [37–40], each user is required to sequentially select several squares in a picture as the password. During the authentication process, the user needs to reselect the preselected squares in the correct sequence.
According to [45], humans are good at remembering one point per image for a sequence of images than multiple points on a single image. This important knowledge is used in the CCPGP systems [41, 42] to improve the usability of authentication. However, the CCPGP system has a storage drawback for requiring a large number of images to be stored on the server.
Recently, the popular Google map is integrated with CCPGP to reduce the storage burden on the authentication server. The Google map graphical password systems (GMGP) [43, 44] enable the users to select password points on the Google map. The password points are represented as coordinates on the map, thus avoiding storing a large number of pictures on the server. Furthermore, comparing with the redrawing-based systems, the GMGP system not only offers a large password space, but also provides a better usability because the action of selecting is usually easier to do than drawing. However, the GMGP system still has its flaws. During the authentication process, as the user reselects the password points on the map, the attacker can detect the path of selection with little effort and then get the password.
In this paper, in order to build a balance between usability and security for authentication, we proposed the VGMSGP scheme. During the authentication process, the user is not asked to select the password points by clicking, but do some actions of slipping, the path of which is not easy to peek. And at the same time, in order to improve the resistance against shoulder-surfing attacks further, we use a specific verification grid in our method.
3. The Proposed VGMSGP System
The proposed VGMSGP is a kind of map-based graphical password system that provides a good usability, a large password space, and an effective resistance against shoulder-surfing attacks.
In this system, a set of fixed grids are pregenerated on the Google map. During the registration process, the user is not only asked to select several points in sequence on the map to form a password route, but also required to choose one of the pregenerated grids as a specific verification grid for the subsequent authentication. During the authentication process, the user needs to slip the map to let each point on the password route sequentially fit inside the specific verification grid. With the specific verification grid and the map slipping strategy, the proposed VGMSGP scheme can effectively defend against shoulder-surfing attacks. Meanwhile, the password points are represented as coordinates on the map; therefore, the proposed scheme has a negligible storage burden.
3.1. Registration
During the registration process, the user will register an account with serval password points in sequence and a specific verification grid. The registration process consists of four steps, each of which is detailed as follows: Step 1: the user selects the size of pregenerated grids, such as 6 × 6, 11 × 11, and 16 × 16. Then, the set of fixed grids and a map are shown on the screen. Note that the size of pregenerated verification grids can be determined based on certain security requirements. Step 2: the user chooses one of the pregenerated verification grids as a specific verification grid. After the first selection, the system will ask the user to confirm the selected verification grid again. If the second selection is the same as the first selection, the verification grid selection is successful. Otherwise, the verification grid selection fails, and the user needs to select the verification grid one more time. Step 3: after the user selects the verification grid, users are required to select several points in sequence on the map to form a password route. By slipping, zooming in, zooming out, and then clicking the map, or directly finding the appropriate point on the map through the search function, the user can set the password points. In addition, the user can operate on either a standard map or a satellite map to facilitate the selection. Step 4: the password points should be selected under the same scale to ensure the accuracy of the password route. To reduce the memory burden of the user, the route between the two password points is set as a straight line rather than the actual road between the two locations. By this means, the user can easily remember the password route with the order of the points on the password route. After the selection of the password points, the user only needs to click on the selected password points in the same order again to complete the confirmation of the password route.
Taking the pattern in Figure 1 as an example, the user first selects a verification grid at . After that, the user needs to click on the place of “Bund Shanghai” and “Shanghai International Conference Center” and finally click and stop at the “East Nanjing Road.” The three points can be used to form a route in “Shanghai.”
Moreover, the system will review the selected password route to ensure security. If the security of the password root cannot meet the minimum requirements of the system, the system will suggest to modify the password route. The system will review the password from the following aspects:(1)The number of password points: insufficient password points will make the password path vulnerable. Therefore, an allowable password path should consist of at least three password points.(2)The distance between the password points: in case that two password points exist at the same time with one verification grid, the distance between each two password points should be greater than a certain distance. This suggestion ensures the precision of the password.(3)The shape of the password path: for maintaining security performance, the password route should be avoided in a simple shape, i.e., a straight line.(4)Popular password routes: inevitably, users are willing to set some popular routes as password routes, which involves risks. Thus, the system will remind users to avoid using these popular routes.
3.2. Authentication
During the authentication process, the user needs to slip the map to let each point on the password route sequentially fit inside the specific verification grid. After that, the users can be authenticated successfully. Step 1: the user first selects the required size of pregenerated verification grids, which corresponds to the security level, and thus system displays the corresponding number of pregenerated verification grids on the upper layer of the map. Step 2: the user slips the map so that the first password point fits inside the verification grid. The preselected verification grid looks the same as any other pregenerated grid but already remembered by the user. Then, the user is required to slip the map so that the remaining points sequentially fit inside the pregenerated grid to pass the authentication. In order to ensure the correctness of the password route, when one password point fits inside the grid, it is necessary to keep the other ones outside the verification grids. Figure 2 illustrates the login process of the password route. In Figure 2(a), the user first slips the map to fit the first point, “Bund Shanghai,” inside the and implements the same operations for the “Shanghai International Conference Center” and the “East Nanjing Road” in Figures 2(b) and 2(c). The pregenerated grid and password route are highlighted for demonstration.
(a)
(b)
(c)
4. Experiments
In this section, we first design two experiments to evaluate the security and usability of VGMSGP compared with DAS system and analyze the experiment results. Then we designed another experiment to evaluate the running time of VGMSGP. Finally, we analyze the storage load of the system.
4.1. Security
For security, we designed two experiments to obtain the success rate of the system under different conditions of shoulder-surfing attacks. The success rate against shoulder-surfing attacks is determined by the number of attacks and the number of times the attacker successfully stole the password. Formally, the success rate against shoulder-surfing attacks can be calculated as . Considering that the password authentication of the system mainly consists of two parts, i.e., the verification grid and the password points, we design the experiments from the two aspects. The first experiment focuses on the influence of the size of the pregenerated grids on the success rate, which evaluates the security performance by calculating the success rate of against shoulder-surfing attacks with different sizes of the pregenerated grids. The second experiment focuses on the impact of the number of selected password points on the success rate against shoulder-surfing attacks, which compares the security performance of the evaluation system for the success rate of against shoulder-surfing attacks with different numbers of password points.
We have solicited 80 participants in the experiments. All the participants had understood the registration and authentication process of the system, and 70 of them have completed the VGMSGP password route registration in the system before the experiment began. In order to evaluate the performance of the system, we also asked them to create a DAS password to compare the performance of the VGMSGP. The password number of each password type is shown in Table 1.
The other 10 participants acted as the shoulder-surfing attackers, peeking the user enter the password route and then trying to reenter it. During the experiment, the users are required to accurately enter the password route a few times. When a password is entered, three attackers peek at the process behind the user each time. The attackers reentered the user's password route when they had observed each participant's password entry. Finally, we recorded ten attacks for each password route. Then we obtained the average success rate of the system against shoulder attacks in this case.
By sorting and analyzing the experimental data, we obtained the following experimental results. The experimental data of VGMSGP are shown in Figures 3 and 4. With the increase of the size of pregenerated verification grids or the number of selected password points, the success rates of the system against shoulder attacks gradually increase. Besides, when the number of password points increased in the early stage, the success rate of the system against shoulder attacks increased significantly. Yet in the later stage when the numbers increased, the rising trend of the success rate of the system against shoulder attacks decreased.
The success rate against shoulder-surfing attacks of DAS compared with VGMSGB is shown in Table 2. The VGMSGP shows better results in the experiment of resisting shoulder attacks. The success rate of shoulder-surfing defense can be increased by 37% to 56% with different grid sizes and password point numbers. Through analysis, we conclude this is because the users do not directly click the password points on the screen, and then the attacker cannot directly get the password route of the user through peeking. In addition, we found that only the password points need to be passed through the verification grids in a certain order. Therefore, there are a variety of ways to enter the password when the user slides the map to verify the password route, which may include some meaningless sliding ways that can increase the security of the system.
4.2. Usability
In this section, we measured the usability of the system by asking users to enter their VGMSGP password and DAS password with an increase of time after successfully registering the passwords. We use the total accuracy of authentication to measure the memorability of the passwords. The total accuracy of authentication is determined by the number of people who reenter the password and the number of people who successfully pass the verification . In other words, the total accuracy of authentication can be calculated as .
We solicited participants who had registered the password to ask them for entering the password route and DAS password again in different periods. After analyzing the success rate of the participants logging in again after different periods, we obtained the following results shown in Figure 5. Compared with DAS, the participants are easier to remember the VGMSGP password route. The usability of passwords can be improved by 3% to 6%, since most of the participants were able to log in again successfully. Besides, we found that the participants were more likely to remember a simple password route than multiple single points. The above results proved that the proposed system has a very slight memory burden on the users, which shows better memorability.
This phenomenon occurred since the users of VGMSGP only need to remember the route consisting of multiple password points without remembering the complex coordinates. We can conclude that our systems have high usability and they are friendly to use in practice.
4.3. System Running Time and Storage
To evaluate the performances of the proposed system in different situations, we measured the running time of the system when the user passed authentication successfully. Note that our system runs in Alibaba Cloud server with CentOS 7 and the mobile devices used in the experiment are all running under the Android 10 OS with 6 GB of running memory.
The running time of successful authentication is averaged by ten groups of data. The experimental data are shown in Figures 6 and 7. The running time increases as the size of pregenerated verification grids increases. Besides, the running time of the system is also affected by the number of selected password points. As shown in Figure 7, with the number of selected password points increasing, the running time of the system also increases. However, even in the case of the maximum running time, the user can still complete the authentication within ten seconds. The running time of the system allows the users to pass verification quickly and securely. The experimental results prove that the system can guarantee security and quick authentication by calling the Google Maps API. According to the above results, the proposed system involves very slight storage and computing burdens on the authentication server and shows a better performance.
We compared the storage space occupied by the two existing systems and VGMSGP mentioned above, as shown in Table 3. The space consumed by MSGB to store passwords is far less than the traditional graphical password system which reduces the storage pressure on the server. When the system cannot call the Google Maps API, such as when it cannot connect to the Internet, the system needs to download the required maps in advance. The system will take up more storage space on the device but can still be used normally and the effect of resisting shoulder-surfing attacks has not decreased.
5. Conclusion
In this paper, we proposed a map-based graphical password system, i.e., VGMSGP, which is effective to resist shoulder-surfing attacks by combing a password route with a verification grid. The password route and the specific verification grid together form the complete graphical password. In the authentication process, the user is required to slip the map to fit each password point inside the preselected verification grid. It makes the system effectively defend against shoulder-surfing attacks. In addition, the use of Google Maps API helps to reduce the storage pressure of the system in a networked environment. It must be mentioned that, in a nonnetwork environment, the user needs to download map files in advance, which will take up more storage space, but system security is not affected. In future works, we will focus on improving the security of graphical password systems against the strong shoulder-surfing attacks, i.e., multiple camera recordings during the users’ login.
Data Availability
The data used to support the findings of this study are available from the corresponding author upon request.
Conflicts of Interest
The authors declare that they have no conflicts of interest.
Acknowledgments
This work was supported in part by the National Natural Science Foundation of China under Grants 61972205, 62032020, and 62122032, in part by the Teaching Reform and Innovation Research Project of Nanjing University of Information Science and Technology under Grant 2021YBJG13, in part by the Ministry of Science and Technology (MOST) under Grant 110-2221-E-259-005-MY2, Taiwan, in part by the Priority Academic Program Development of Jiangsu Higher Education Institutions (PAPD) fund, in part by the Collaborative Innovation Center of Atmospheric Environment and Equipment Technology (CICAEET) fund, and in part by the NUIST Students’ Platform for Innovation and Entrepreneurship Training Program under Grant 202110300049.