A New Shoulder Surfing and Mobile Key-Logging Resistant Graphical Password Scheme for Smart-Held Devices

Abstract

In globalization of information, internet has played a vital role by providing an easy and fast access of information and systems to remote users. However, with ease for authentic users, it has made information resources accessible to unauthorized users too. To authorize legitimate user for the access of information and systems, authentication mechanisms are applied. Many users use their credentials or private information at public places to access their accounts that are protected by passwords. These passwords are usually text-based passwords and their security and effectiveness can be compromised. An attacker can steal text-based passwords using different techniques like shoulder surfing and various key logger software, that are freely available over internet. To improve the security, numerous sophisticated and secure authentication systems have been proposed that employ various biometric authentication systems, token-based authentication system etc. But these solutions providing such high-level security, require special modification in the design and hence, imply additional cost. Textual passwords that are easy to use but vulnerable to attacks like shoulder surfing, various image based, and textual graphical password schemes are proposed. However, none of the existing textual graphical passwords are resistant to shoulder surfing and more importantly to mobile key-logging. In this paper, an improved and robust textual graphical password scheme is proposed that uses sectors and colors and introducing randomization as the primary function for the character display and selection. This property makes the proposed scheme resistant to shoulder surfing and more importantly to mobile key-logging. It can be useful for authentication process of any smart held device application.

A Systematic Review of Graphical PasswordMethods Resistant to Shoulder-surfing Attacks

“…The wide range of evaluation methods and metrics used in graphical password studies makes it challenging to compare and synthesize findings across the field. For usability evaluations, studies employ various methods such as user experiments, surveys, and theoretical analysis, with metrics spanning success rate, login time, error rate, SUS score, and qualitative feedback (Meng and Liu, 2018;Mackie and Yıldırım, 2018;Hanif et al, 2019). Similarly, security evaluations use different approaches like theoretical analysis, attack simulations, and user studies, considering various attack models (Wang et al, 2022;Yu et al, 2017;Ratchasan and Wiangsripanawan, 2019).…”