Multifactor Graphical Password Authentication System using Sound Signature and Handheld Device

Transcription

1 Multifactor Graphical Password Authentication System using Sound Signature and Handheld Device Jyoti Rao *1,Kishan Mistry #2, Bhumika Mistry #3, Divya Malviya #4, Devesh Gudway #5 # Student & Department of Computer Engineering, Padmashree Dr. D. Y. Patil Institute of Engineering & Technology, Pimpri, Pune, Maharashtra, India. * Faculty & Department of Computer Engineering, Padmashree Dr. D. Y. Patil Institute of Engineering & Technology, Pimpri, Pune, Maharashtra, India. Abstract Every system uses text password but provide poor security. Graphical passwords on the other hand provide greater security and are easy to remember. In this paper we present various authentication schemes using graphical passwords. These provides potential solution to the flaws of text as well as graphical passwords. In this system we present two modes of graphical password authentication system i.e. offline and online. The offline mode consists of a graphical password integrated with sound signature, whereas the online mode focuses on Cued Click Point (CCP) based pattern using encryption and decryption. Keywords Security, Authentication, Sound signature, Graphical password, CCP, handheld devices. I. INTRODUCTION Traditional authentication systems uses text passwords which includes username and password. These passwords fails to provide the desired level of security. Text passwords, once chosen and learned, the user must able to recall it at the time of login, which makes them hard to remember. However if we keep changing our password frequently it is more vulnerable to be forgotten [6]. To reduce brute force attacks the user should select long passwords which include characters as well as numbers. This makes them all the more difficult to remember. Text passwords include risks of shoulder surfing, hidden cameras and spyware attacks. Also they are prone to dictionary attacks and keyboard sniffers. Thus they are not much reliable and hence for greater security we can use graphical passwords. Number of graphical password systems have been developed. Studies shows that text based password suffer with both security and usability problems. According to Picture Superiority Effect Theory, concepts are more likely to be recognized and remembered if they are presented as pictures rather than words. [2]. A graphical password is an image that is uploaded by the user or provided by the server [3]. The user has to click on various points on the image that leads to successful authentication. The user enters the password by clicking on a set of images, specific pixels on an image or by drawing a secret pattern in a predefined manner. A click based graphical password scheme called Cued Click Points uses a sequence of images in which user can select one click point per image or multiple points on a single image. These click points can either be selected by the user or they can be generated randomly by a server at the time of registration. At the time of logging in, the click points selected by the user are verified by the user with the points provided by the user at the time of registration or those provided by the server. If the number of possible pictures is made very large then it offers better resistance to dictionary attacks. It is also difficult to make automated attacks for graphical passwords. Thus graphical passwords presumably a higher usability compared to text based passwords. However in graphical passwords, users have predefined tap regions on one image to form a password. User entered a password by clicking on these regions in a specific order. This scheme is vulnerable to shoulder surfing and suffers from having a predetermined and a very small password space. Visual attention research shows that different people are attracted to the same predictable regions in an image. These regions are known as hotspots. If users select their own click-based graphical passwords without guidance, presence of hotspots will remain an issue. In order to overcome these drawbacks of text as well as graphical passwords, we integrate our system with universal multifactor authentication scheme. Multi-factor authentication is a way of authentication in which two or more independent factors are used as a part of user credentials. Multi-factor authentication is accomplished in our system by combining graphical passwords with another factor. This factors can include smart cards, USB tokens, handheld devices or one-time ISSN: Page 516

2 password token. In our system another factor is provided using sound signature in offline mode and using encryptiondecryption in online mode, both implemented on a handheld device. Having two or more factors strengthens but also complicates the authentication process. The rest of the paper has been organized as follows: Section II describes the various graphical password based system that have already been implemented. Section III describes our system architecture and the methodology that we are going to use. Section IV describes the algorithmic steps for the proposed methodology, and finally we discuss about the future scope of the project and conclude in Section V. II. RELATED WORK Many systems have been implemented that use graphical passwords. The best known of these systems are Passfaces, Click based graphical passwords, Pass-Point system, Persuasive click point systems. Blonder proposed a graphical authentication scheme called graphical password, based on cued recall. In this scheme the user creates a password by clicking on several location on an image, which are stored in the database. The user must click on the approximate areas of location for authentication [4]. Susan Wiedenbeck proposed and enhanced graphical authentication system called Pass-Points [3]. This idea is based on selection of a sequence of multiple click points on a single image as password. At the time of authentication the image is displayed on the screen by the system. The user needs to click on several previously chosen locations in a single image to login. Any pixel value in the image is a candidate for a click point. The problem with this scheme is that the number of predefined regions is small, perhaps a few dozen in a picture, leading to hotspots and pattern formation attacks. The password may have to be having 12 click points for sufficient security, thereby making it difficult for the user to remember. Cued Click Points (CCP) is a proposed alternative to pass points suggested by Sonia et al, designed to reduce patterns and usefulness of hotspots [5]. In CCP, user clicks one point each on multiple images rather than multiple points on a single image. It offers cued recall and introduces visual cues that instantly alerts valid users if they have made a mistake when entering the latest click point (at which they can cancel their attempt and retry from the beginning). Hotspot based attacks become more challenging. Each click results in showing a next image, thus leading users down a path as they click on their sequence of points. A wrong click results in an incorrect path with an explicit indication of authentication failure only after the final click. Real User Corporation developed a graphical authentication technique called Passfaces, in which a user logs onto a system by choosing the required number of faces from a grid of faces, thus proving additional security to a general text based password system. This technique is based on human s verse ability to recognize human faces [4]. R.Dhamija and A.Perrig mentioned a major authentication problem i.e., user s tend to have remembering secure passwords. In order to overcome this problem, he suggested a solution called Déjà vu in which the user has to select a particular number of images from a set of random pictures called challenge set. At the time of validation the user has to identify the preselected images. Another approach, known as Drawmetric password scheme, in which the user needs to draw a simple outline of the password at the time of registration and to be authenticated, similar drawing must be redrawn by the user [6]. Cognometric authentication is another approach in which the user has to identify a series of recognized images among a larger set of decoy images [4]. Jermyn introduced an authentication technique called Draw A Secret (D-A-S) which is basically intended for devices with stylus inputs such as Personal Digital Assistants (PDAs). Here, the user shall draw a secret drawing (password) on a 2D grid. The co-ordinates of this drawing on the grid are stored in order and the system verifies the drawing by checking the directions of the drawn stroke on the grid [6]. III. A. System Architecture: PROPOSED METHODOLOGY 1) Offline mode: In the offline mode, we have integrated sound signature along with graphical password. The multifactor authentication scheme here includes click points and handheld device. The idea of sound signature is inspired by human ability to recall objects by listening to a sound related to that particular object. The offline mode consists of basically 3 modules, i.e. Registration, Login and Verification modules. The Registration mode includes registering the user along with its details. These details comprises of a unique user-id (UID), Precision Value, address and phone number. The registration process proceeds further by allowing the user to select images, their respective click points and sound signature. Selection of image can either be done using the handheld device s in-built camera or using the ones that are already present the device. The user can select any click point on the image. Similar to images, selection of sound signature can either be done by choosing one of the already present sounds or by recording one s own voice that helps in recalling the object. Once done the user clicks on the sign up button, thus generating a user profile vector which is stored in the database. The profile vector consists of: User-vector (UID, precision, , Phone number) Image vector (UID, image-id) Click point vector (UID, image-id, click point co-ordinates(x,y)) The precision value helps to draw a circle around the click point which provides a tolerance region in which the user is allowed to click during the time of login. In Login mode, we first enter ISSN: Page 517

3 the user id, which if found, retrieves the respective set of images and the related sound signature from the database. Once the images and the audio are loaded, the user needs to select the click point on each of the image. The sound helps to remember click points (in case the user forgets the click point on a particular image). At this moment, a login vector is created. The login vector comprises of click points selected by the user during the login phase. Once the user selects all the click points, he/she clicks on the validate button in order to verify the click points. This module compares the click points registered in the database with the ones in the login vector. A successful login indicates the exact match of click points. Fig. 1 System Flowchart for Offline mode. 2) Online mode: In this approach, we use a handheld device that acts as a terminal, a server or a challenger which is a typical online web service provider. The server controls storage, retrieval of data and sending of images to the handheld device. This mode also includes 3 modules namely same as in the offline mode. The first screen (in Registration module) on the terminal asks the user for its unique user id, precision value, address, phone number. In the next step the user selects the number of desired click points. Along with that the user also needs to choose the sequence of click points which he/she will have to remember in order to login into the system. Thus a user profile is generated and sent to the server. ISSN: Page 518

4 Fig 2. System Flowchart for Online mode At the time of login, the user needs to enter the registered user id on the terminal side. The terminal sends a request to the server for generating an image with a number of click points on it. The server accepts the request, generates random click points on the image and sends the encrypted image to the handheld device. AES i.e. Advanced Encryption Standard technique is used for encryption. The encrypted image, now received on the terminal, is decrypted. The user now needs to select the click points in the same sequence which he/she had selected during the registration phase. The image provided by the server will have a number of click points each numbered with a single digit. The position of the click points will change every time a server responds to a request, however the sequence of click points is the main key to access login into the system. The addition click points are added just to confuse the unauthorized user. The verification module includes verification of the sequence of click points during the time of login with the one at the time of registration. An exact match of sequence leads to a successful login. ISSN: Page 519

5 IV. ALGORITHM 1. Start. 2. Select mode i.e online or offline mode. 3. If mode selected is offline 3.1. Select operation i.e Registration or Login If operation is Registration Enter user if, precision value, id and phone number Select an image from the device gallery or using camera Select click point and sound signature for that image For more number of images goto step else goto step Create user profile vector Store the user profile vector in the database If operation is Login Enter user-id to fetch image and sound signature from the database Play sound signature Select click point Compare click point including precision value with the one stored in the database for each image If valid for all images, Login successful else failure. 4. If the mode selected is online 4.1. Select Operation i.e Login Or Registration 4.2. If Operation selected is Registration Enter User Id, id, Phone No, and the number of Click Points Enter a sequence for the clicks Create User Profile Vector Store it in Database at Server If Operation selected is Login Enter User Id to request the Server to send a random image Server selects a random image and creates random position for click points which are numbered and send it to the User s handheld device User clicks on the image according to his sequence The sequence is sent to the Server Server verifies the sequence If Match of Sequence occurs,login is successful else failure 5. Stop. V. RESULT The Graphical password scheme used along with sound signature provides a better recall based security system compared to pure text passwords or pure graphical passwords. On the other hand, graphical passwords where the click points are randomly generated avoids shoulder surfing, dictionary attacks. Guessing of passwords in both the cases is difficult. Since we are using encryption technique (AES) for transmission over the network, brute force attacks are avoided. VI. CONCLUSION AND FUTURE SCOPE Text based authentication schemes face usability and security issues even though they are the most commonly used technique worldwide. Graphical passwords are easier to remember than text based passwords, but even the existing graphical password authentication systems have major drawbacks. In this paper, we propose a new graphical password system that overcomes difficulties like hotspot prediction, shoulder surfing, dictionary attacks. The system combines graphical passwords along with a handheld device and sound signature to form a multifactor authentication system. The generation of random click points during the online mode prevents the shoulder surfing attack as well as dictionary attacks. Storing the images at the server provides better security as compared to offline mode. The scope of the project can be further improved by using various techniques like Sudoku. The passwords can be changed every minute, thus making the user free from remembering passwords. He does not have to register on each and every website. Passwords are automatically generated and changed every time the user has to login. REFERENECES [1] S. Singh, and G. Agarwal, Integration of Sound Signature in Graphical Password Authentication System, IJCA January [2] A. P. Sabzevar, A. Stavrou, Universal Multifactor authentication system using Graphical Password. [3] S. K. Bandyopadhyay, D. Bhattacharyya, P. Das, User Authentication by secured graphical Password Implementation, IEICE [4] S. Malempati, S. Mogalla, Grid based approach for Data Confidentiality, IJCA July 2011 [5] V. Priya darshini, A. Gomathi, N. Saravanaselvam, A Novel based Multilevel Graphical Authentication System, IJARCCE Vol 2, September [6] T. Srinivasa Ravikiran, K.V.S. Rao, M. K. Rao, A. Srisaila, A symbol based graphical schema resistant to peeping attack, IJCSI Vol 10 on September [7] I. Jermyn, A. Mayer, F. Monrose, M. K. Reiter, A.D. Rubin, Design and Analysis of Graphical Password, The USENIX Association. ISSN: Page 520