International Journal of Pure and Applied Sciences and Technology

Transcription

1 Int. J. Pure Appl. Sci. Technol., 1(2) (2010), pp International Journal of Pure and Applied Sciences and Technology ISSN Available online at Research Paper Security Analysis of Graphical Passwords over the Alphanumeric Passwords G. Agarwal 1,*, S. Singh 2 and R.S. Shukla 3 1 Deptt.of Computer Science, IIET, Bareilly, India 2,3 Deptt. of Information Technology, IIET, Bareilly, India * Corresponding author, (gauravagarwal95@gmail.com) (Received: ; Accepted: ) Abstract: Security in the computer is largely supported by the passwords for authentication process. The most common approach for authentication is alphanumeric passwords and alphanumeric passwords which has significant drawbacks. To overcome these drawbacks graphical passwords have been designed. That aim of generating these passwords to make passwords more memorable and easier for people to use and, therefore, more secure. In this paper we are presenting the comparison between the alphanumeric passwords and graphical password. Keywords: Graphical passwords, alphanumeric passwords, authentication, security. 1. Introduction Traditionally, alphanumeric passwords have been used for authentication, but they are known to have security and usability problems. Now day s graphical passwords are other alternatives. Our paper reports to the comparison study between the different graphical password schemes and the alphanumeric passwords. The passwords require the following fundamentally requirements so that the problems with passwords arises [1]. (a) Passwords should be easy to remember, and the user authentication protocol should be executable quickly and easily by humans. (b) Passwords should be secure, i.e. they should look random and should be hard to guess Main problems with alphanumeric passwords

2 61 The main problem with the alphanumeric passwords is that once a password has been chosen and learned the user must be able to recall it to log in. But, people regularly forget their passwords. If a password is not frequently used it will be even more susceptible to forgetting. The recent surveys have shown that users select short, simple passwords that are easily guessable, for example, personal names of their family members, names of pets, date of birth etc [2].the most important issue is having a password that can be remembered reliably and input quickly. They are unlikely to give priority to security over their need to get on with their work Need of graphical passwords Graphical password were originally described by Blonder(1996).the basic need for graphical password is that graphical passwords are expected to be easier to recall, less likely to be written down and have the potential to provide a richer symbol space than text based password. For example, a user might authenticate by clicking a series of points on an image, selecting a series of tiles, or by drawing a series of lines on the screen [3]. 2. Techniques for graphical passwords For the comparison purpose we studied many techniques for generating the graphical password. The brief idea of them is as follows. 2.1 Image Based Authentication Zhi Li, Qibin Sun (2005) presented image based authentication. The IBA rests on the human cognitive ability of association-based memorization to make the authentication user friendly, comparing with traditional textual password [4]. 2.2 Draw-A-Secrets (DAS) It is a typical implementation based on the user drawing in a grid canvas. Currently; too many constraints result in reduction in user experience and prevent its popularity. In this user personalities have a great influence on the drawings and therefore make it harder for others to imitate. Additionally, users can draw the secrets small enough to resist shoulder surfing [5]. 2.3 Toon Passwords In this research another password system designed in which memorably problem was developed. Toon passwords are an alternative to traditional text passwords. It has drawn the best usability features of existing system, but enhanced security. It reduces the memory load

3 62 on the users by giving them familiar cartoon characters which are demonstrate and are easier to recall than a typical secure text password [6]. 2.4 In year 2008 Paul Dunphy described a technique by collecting a corpus of naturalistic description of a set of 45 faces, he explored user s ability to associate descriptions with faces across the conditions in which the decoy faces were selected. The conditions were randomly, on the basis of their visual similarity to the target face and on the basis of the similarity of the verbal description of the decoy faces to the target face [7]. 2.5 Multifactor Authentication A new authentication scheme based on the graphical password and multifactor authentication. In this technique the researchers employed the user s personal handheld device as the password decoder and the second factor of authentication. In this method a service provider challenges the user with an image password. To define the appropriate click points, the user needs some hint information transmitted only to his handheld device [8]. 2.6 Mohammed Misbahuddin in year 2009 proposed a two factor password authentication key agreement mechanism using graphical password where the user needs to recognize his secret image presented to him as challenge. The scheme allows the user to select images from a given set of image categories. 3. Results These are the some common techniques designed by the researchers. Based on these researches we prepare the comparison report between alphanumeric and graphical passwords against the following points. 3.1 Password Learning After selecting a password, users practiced their password to learn. In our study the criteria for success was 15 correct logins. Users continued to input the password until the criterion was met. We prepare the comparison between incorrect password submissions [table 1]. Number of incorrect submission alphanumeric graphical Table 1 (number of participants making incorrect password submission in the learning phase)

4 63 In study out of 25 alphanumeric participants 15 had no incorrect inputs, 4 had one incorrect input,3 had two incorrect input. In graphical password users 8 had no incorrect inputs, had one incorrect input, and 2 had two incorrect inputs. According to these data we analyze that the learning of graphical password is better than alphanumeric password. 3.2 Password remembering In the retention of passwords users input the password three times. In each retention trial the user had to enter their password correctly only one time. The number of incorrect password submission and time for the correct submission are shown below [table 2]. Number Incorrect submissions of mode Mean R 1 (SD) Mean R 2 (SD) Mean R 3 (SD) Alphanumeric 1.61(1.63) 2.82(3.93) 1.43(2.76) Graphical 0.28(0.82) 2.24(2.77) 1.20(2.52) Time for correct submission(seco nds) Alphanumeric 9.01(4.56) 22.53(13.32) 20.76(17.58) Graphical 5.28(1.70) 9.87(3.91) 8.99(3.43) Table 2 Standard deviation of number of incorrect password submission and time for the correct submission (for number of users 25 in both cases) For the analysis of retention we used the mat lab. The analysis shows that the for the factor retention trial(r 1/R 2/R 3) and mode (alphanumeric/graphical) the mean of incorrect submission in graphical password is always less than alphanumeric password (0.28<1.61,2.24<2.82,1.20<1.43) as well as any user forget his password then we can see that the time for correct submission for graphical password is less then the alphanumeric passwords. 3.3 number of attempt to remember password

5 64 number of attempts Alphanumeric Graphical The graph shows the alphanumeric passwords take many attemts to remember the passwords but graphical passwords are very likely to remember the passwords.these graphs are genrated with the records given in table Time Requirement The time requirement shows the requirement of time for generating the passwords. Table 3 shows the mean time for generating the time for both type of passwords in seconds and the graph shows the comparison result between. The results are based on the calculation done for the three retention values as in table 2.in the result we can see that the time for generation the graphical password is greater then the alphanumeric passwords. Time for generating the password (seconds) alphanumeric graphical Table 3 time in seconds for genration of password.

6 65 Comarision between the time required for genration the passwords; series 1 for alphanumeric and seies 2 for graphical passwords. 4. Conclusion This work focused on the usability of graphical passwords over the alphanumerical passwords which seems to hold out the prospect of a much more secure system.it is easy to generate a large passwords for secure system however it will take some extra time for generation over the alphanumeric passwordsthe past decade has seen a growing interest in using graphical passwords as an alternative to the traditional text-based passwords. In this paper, we have conducted a comprehensive study beteen the alphanumeric and graphical passwords. The main reason for adaption of graphical password is that people are better at memorizing graphical passwords than text-based passwords.overall the current graphical password techniques are still need improvement against shoulder surfing attack and dictionary attack etc.but still these techniques are much better then the alphanumeric password techniques. References [1] Wiedenbeck,Waters,Birget,Broditskiy & Memon,2005 The password problem [2] Brown,Bracken,Zoccali,&Douglas, Sasse et al., 2001; 2004 [3] Bogdan Hoanca and Kenrich Mock, Secure graphical password system for high traffic public areas ETRA ' [4] Zhi Li, Qibin Sun, Yong Lian, and D. D. Giusto, An Association-Based Graphical Password Design Resistant to Shoulder-Surfing Attack, IEEE International Conference on Multimedia and Expo (ICME) ,2005, pp

7 66 [5] Haichang Gao, Xuewu Guo, Xiaoping Chen, Liming Wang, and Xiyang Liu, YAGP: Yet Another Graphical Password Strategy, Annual Computer Security Applications Conference (ACSAC) ,2008 pp [6] Cheryl, Hinds and Chinedu Ekwueme, Increasing security and usability of computer systems with graphical passwords, Proceedings of the 45th annual southeast regional conference, ACM,ISBN: [7] Paul Dunphy, James Nicholson, Patrick Oliver, Securing passfaces for description, Proceedings of the 4th symposium on Usable privacy and security, ACM ISBN: [8] Alireza Pirayesh Sabzevar, Angelos Stavrou, Universal Multi-Factor Authentication Using Graphical Passwords, IEEE International Conference on Signal Image Technology and Internet Based Systems (SITIS) ISBN: