A Text based Authentication Scheme for Improving Security of Textual Passwords

Abstract

Abstract-User authentication through textual passwords is very common in computer systems due to its ease of use. However textual passwords are vulnerable to different kinds of security attacks, such as spyware and dictionary attacks. In order to overcome the deficiencies of textual password scheme, many graphical password schemes have been proposed. The proposed schemes could not fully replace textual passwords, due to usability and security issues. In this paper a text based user authentication scheme is proposed which improves the security of textual password scheme by modifying the password input method and adding a password transformation layer. In the proposed scheme alphanumeric password characters are represented by random decimal numbers which resist online security attacks such as shoulder surfing and key logger attacks. In the registration process password string is converted into a completely new string of symbols or characters before encryption. This strategy improves password security against offline attacks such as brute-force and dictionary attacks. In the proposed scheme passwords consist of alphanumeric characters therefore users are not required to remember any new kind of passwords such as used in graphical authentication. Hence password memorability burden has been minimized. However mean authentication time of the proposed scheme is higher than the textual password scheme due to the security measures taken for the online attacks.

A Simple and Secure Reformation-Based Password Scheme

“…In [10], a text-based authentication scheme was introduced. Nine to ten different characters are attached to each numeric digit.…”

“…The aforementioned reformable approaches improved the security using extra devices [5], [21], high cognitive overhead [5], [9], [12], [13], multiple interfaces for each character of password [6], focusing on the client-side and not providing server-side database security [5]- [7], [10]- [13], [21]. However, they are losing usability due to complex interfaces as in [5], [9], [10] and extra keys entry against each password character [5], [9], [11], [12]. Additionally, the use of different devices (earphones) in [5], [21] acts as a threat to security if its sound is leaked out.…”

“…1. The token-based scheme is not reliable because the security key information printed over the smart card can be stolen and misused [10]. The biometric authentication is also unreliable because dummy thumbprints can be formed from different objects like glass and metal…”

“…when touched and misused by adversaries [10], [19]. Moreover, both the token and biometric-based schemes require additional hardware(s), making them expensive and complicating their usability [14].…”

“…However, these reformation based password schemes achieved client-side security at the cost of losing usability. For instance, the extra keystrokes, i.e., several keys are pressed for entering single characters [5], [9], [11], user computation [5], [13], entering metadata [12], [13], using large character set [5], [10], [37], [39], and use of additional device like earphone [5], [21] are required for completing the login process. The use of the extra device(s) complicates usability and acts as a threat to client-side security if used in crowded places.…”