A Shoulder Surfing Resistant Graphical Authentication System

   A Shoulder Surfing Resistant Graphical
                Authentication System

TEXTUAL passwords have been the most widely used authentication method for decades. Comprised of number sand upper- and lower-case letters, textual passwords are considered strong enough to resist against brute force attacks. However, a strong textual password is hard to memorize and recollect. Therefore, users tend to choose passwords that are either short or from the dictionary, rather than random alphanumeric strings.  Various graphical password authentication schemes were developed to address the problems and weaknesses associated with textual passwords. Based on some studies such as those in , humans have a better ability to memorize images with long-term memory(LTM) than verbal representations. Image-based passwords were proved to be easier to recollect in several user studies As a result, users can set up a complex authentication password and are capable of recollecting it after a long time even if the memory is not activated periodically. The human actions such as choosing bad passwords for new accounts and inputting passwords in an insecure way for later logins are regarded as the weakest link in the authentication chain . Therefore, an authentication scheme should be designed to overcome these vulnerabilities. In this paper, we present a secure graphical authentication system named Pass Matrix that protects users from becoming victims of shoulder surfing attacks when inputting passwords in public through the usage of one-time login indicators. A login indicator is randomly generated for each pass-image and will be useless after the session terminates. The login indicator provides better security against shoulder surfing attacks, since users use a dynamic pointer to point out the position of their passwords rather than clicking on

the password object directly.

Existing System

TEXTUAL passwords have been the most widely used authentication method for decades. Comprised of number sand upper- and lower-case letters, textual passwords are considered strong enough to resist against brute force attacks. However, a strong textual password is hard to memorize and recollect. Therefore, users tend to choose passwords that are either short or from the dictionary, rather than random alphanumeric strings.

.

Proposed System

      Various graphical password authentication schemes were developed to address the problems and weaknesses associated with textual passwords. Based on some studies such as those in , humans have a better ability to memorize images with long-term memory(LTM) than verbal representations. Image-based passwords were proved to be easier to recollect in several user studies As a result, users can set up a complex authentication password and are capable of recollecting it after a long time even if the memory is not activated periodically.

                                           The human actions such as choosing bad passwords for

new accounts and inputting passwords in an insecure way for later logins are regarded as the weakest link in the authentication chain [16]. Therefore, an authentication scheme should be designed to overcome these vulnerabilities.

In this paper, we present a secure graphical authentication system named Pass Matrix that protects users from becoming victims of shoulder surfing attacks when inputting passwords in public through the usage of one-time login indicators. A login indicator is randomly generated for each pass-image and will be useless after the session terminates. The login indicator provides better security against shoulder surfing attacks, since users use a dynamic pointer to point out the position of their passwords rather than clicking on

the password object directly.

Module Description

1.                Multi Layer Image Authentication

2.                Grid Image Authentication

3.                Color Image Authentication

4.                 Random Guess Attack

5.                Login / Register

6.                Upload Image

7.                View Status

8.                View Requests

9.                Approve / Cancel

1.    Multi Layer Image Authentication

To overcome  the security weakness of the traditional PIN method,  the easiness of obtaining passwords by observers in public, and  the compatibility issues to devices, we introduced a graphical authentication system called Pass Matrix. In Pass Matrix, a password consists of only one pass-square per pass-image for a sequence of n images. The number of images (i.e., n) is user-defined. Bellow figure  demonstrates the proposed scheme, in which the first pass-square is located at  in the first image, the second pass-square is on the top of the smoke in the second image at , and the last pass-square is at  in the third image. In Pass Matrix, users choose one square per image for a sequence of n images rather than n squares in one image as that in the Pass Points  scheme. Based on the user study of Cued Click Points  . CCP method does a good job in helping users recollect and remember their passwords. If the user clicks on an incorrect region within the image the login will be failed

2.    Grid Image Authentication

            In this type of authentication multiple images can be provided to the user, the user has the select the image that he can to log in, this will the provide more security.

3.     Color Image Authentication

        In this type the authentication is user by the color coordinates of that position.  In normal Authentication the password is setting according to the regions. But in this type of authentication we choose the color coordinates for password setting

4.       Random Guess Attack

                             To perform a random guess attack, the attacker randomly

tries each square as a possible pass-square for each pass image until a successful login occurs. The key security  determinants of the system are the number of pass-images and the degree of discretization of each image. To quantify the security of Pass Matrix against random guess attacks, we define the entropy of a password space as in equation 3. Table 7 defines the notations used in the equation. If the entropy of a password space is k bits, there will be 2kpossible passwords in that space.

                             

                                    Entropy = log2((Dx _ Dy)i)n

5.     Login / Register

The application will provide a secure user-id/password based secured login mechanism to access its services.

6.     Upload Image

This is the main module in this application . The Main Process in the Mex application will be worked here. The bill picture is already stored in the mobile gallery . the user will select the picture from the gallery and upload in to the server. And also upload the details like employee name , employee id and Bill details. All the details uploaded here is stored in to the wamp server

7.      View Status

After uploading the details the  user can check the status of the request using the same application. The status will be shown as pending until the higher authority accept or cancel the Request

8.     View Request

The User Requested data can be view by the Higher authority. Admin is the authority to accept or reject the request. This module is done by using PHP. The Admin will use System to view the request

9.     Approve / Cancel

After viewing the Request the admin can  have the permission to accept or reject the request. The  user can check the status

Algorithms Implemented

         

1.       Random Guess Attack

                             To perform a random guess attack, the attacker randomly

tries each square as a possible pass-square for each pass image until a successful login occurs. The key security  determinants of the system are the number of pass-images and the degree of discretization of each image. To quantify the security of Pass Matrix against random guess attacks, we define the entropy of a password space as in equation 3. Table 7 defines the notations used in the equation. If the entropy of a password space is k bits, there will be 2kpossible passwords in that space.

                              

                                    Entropy = log2((Dx _ Dy)i)n

Conclusion

With the increasing trend of web services and apps, users are able to access these applications anytime and anywhere  with various devices. In order to protect users’ digital property, authentication is required every time they try to access their personal account and data. However, conducting the

authentication process in public might result in potential shoulder surfing attacks. Even a complicated password can be cracked easily through shoulder surfing. Using traditional textual passwords or PIN method, users need to

type their passwords to authenticate themselves and thus these passwords can be revealed easily if someone peeks over shoulder or uses video recording devices such as cell phones.

                                 To overcome this problem, we proposed a shoulder surfing

resistant authentication system based on graphical passwords, named Pass Matrix. Using a one-time login indicator per image, users can point out the location of their pass-square without directly clicking or touching it,

which is an action vulnerable to shoulder surfing attacks. Because of the design of the horizontal and vertical bars that cover the entire pass-image, it offers no clue for attackers to narrow down the password space even if they have more than one login records of that account. Furthermore,

we implemented a Pass Matrix prototype on Android and carried out user experiments to evaluate the memorability and usability. The experimental result showed that users can log into the system with an average of 1:64 tries (Median=1), and the Total Accuracy of all login trials is 93:33% even two

weeks after registration. The total time consumed to log into Pass Matrix with an average of 3:2 pass-images is between 31:31 and 37:11 seconds and is considered acceptable by 83:33% of participants in our user study.

Based on the experimental results and survey data, Pass Matrix is a novel and easy-to-use graphical password authentication system, which can effectively alleviate shoulder-surfing attacks. In addition, Pass Matrix can be applied To any authentication scenario and device with simple input and output capabilities. The survey data in the user study also showed that Pass Matrix is practical in the real world.

      The Application is one of the useful application in the current situation.  This is the easy way to communicate with the admin.   Employee expense claim workflow became an early candidate for enablement as it could eliminate handling of supporting expense bills and instead use the camera of Smartphone to capture the bill