A Comparison Between Position-Based and Image-Based Multi-Layer Graphical user Authentication System

Abstract

System security is very important, especially in the age that we live in. One of the ways to secure data is by creating a password that makes it difficult for unauthorized user to gain access to the system. However, what makes it difficult for the system to be attacked is directly dependent on approach used to create it, and how secured it is. Text based approach is the oldest authentication approach. It requires that the user supplies textual password in order to gain access to the system. However, this approach has shown a significant drawback and several vulnerabilities, one of which is the difficulty in recalling or remembering textual passwords. Several other attacks that textual passwords are vulnerable to include brute force attacks, shoulder spying, dictionary attacks etc. The introduction of graphical schemes made things a lot better. Graphical passwords make use of images. However, most graphical schemes are vulnerable to shoulder surfing attacks. In this research work, we developed two systems; A position-based multi-layer graphical user authentication system and an Image-based multi-layer graphical user authentication system. The reason behind this research work is to compare the two systems, and evaluate them based on three major performance metrics: (1) Security, (2) Reliability (3) Individual preference.

Choice-Based Graphical Password (CGP) Scheme for web applications

“…Nearly no new approaches or schemes on GP for web apps were done between 2016 and 2020, and researchers preferred to use GP in cloud computing and mobile computing instead [18][19][20][21][22][23][24]. They tended to improve the GP for cloud services and web applications start in 2020 [1,18,19,[22][23][24][25][26][27][28][29].…”

“…Cloud computing is an internet service environment using shared information, resources, software, and hardware per user's demand or company's request to access their data from anywhere or at any time. So, The GP schemes used for web applications can be used for cloud computing to successfully authenticate users before they take the privilege to access their resources or data [1,[18][19]22].…”

“…This methodology was conducted to investigate the user's satisfaction, usability, login time, and performance [19]. In Abhijith [22], at registration, the user enters a picture and then chooses regions in the images called POI. The system represents the POI with a circle; this POI can be ordered or random, and then the user either writes a text inside or quits.…”

“…The Pass-Face technique is a weak GP as it has a short password space, but it is nearly the most preferred GP from users as the faces can be remembered easily compared to other images [19], so we used it in our comparison to prove our CGP usability and memorability. The cued recall is less usable than recognitions, but it's more secure because of its strength and large password space [1,3,9,18,19,22]. So, we used a recall technique by S. Gokhalea [16] to prove our CGP security compared with the recall techniques and Vaddeti [17] as a recognition technique.…”

“…There wasn't a determined formula for SP or calculating the possible passwords, as there were many methodologies of recognition techniques and each needed different requirements, but it mainly depended on the row size [18]. We can measure the Ps using the algorithms [18,20,22,23,24] that calculate the Ps using two equations.…”