Category-Based Graphical User Authentication (CGUA) Scheme for Web Application

Abstract

Graphical user authentication (GUA) is an alternative replacement for traditional password that used text-based form. Even though GUA has high usability and security, it is also facing security attacks that legitimate from the traditional password such as brute force, shoulder surfing, dictionary attack, social engineering, and guessing attacks. The proposed category-based graphical user authentication (CGUA) scheme is developed for web application and based on image category. This category image is inspired from the Hanafuda Japanese card game. The scheme also involved several security features such as decoys, randomly assigned, hashing, limited login attempts, and random characters to strengthen the CGUA scheme. Overall, the proposed CGUA scheme was able to mitigate known attacks based on the security features analysis.

Choice-Based Graphical Password (CGP) Scheme for web applications

“…So, a graphical password is sometimes called Graphical User Authentication (GUA) [5]. GUI produced by the system During the Authentication process, the user must recognize the selection he previously selected during the registration step [1,[6][7][8][9][10]. In the second type, pure recall-based, the user must produce his graphical password, which he generated in the registration phase.…”

“…In this case, unlike the previous type, the user needs to reproduce his password without any given reminder, Such as drawing a particular shape. In contrast, in cued recall-based systems, several specific locations within an image can be selected as the graphical password [9,[11][12][13]. There are many examples of GP techniques.…”

“…The Pass-Face technique is a weak GP as it has a short password space, but it is nearly the most preferred GP from users as the faces can be remembered easily compared to other images [19], so we used it in our comparison to prove our CGP usability and memorability. The cued recall is less usable than recognitions, but it's more secure because of its strength and large password space [1,3,9,18,19,22]. So, we used a recall technique by S. Gokhalea [16] to prove our CGP security compared with the recall techniques and Vaddeti [17] as a recognition technique.…”