Varun Almaula and Taurin Tan-atichat
March 23, 2007
CSE 227
Security Research Project
Deterring Shoulder-Surfing Using Inverting Graphical Authentication
Introduction and Motivations
Graphical passwords are gaining popularity as an authentication
mechanism. Users of such systems authenticate themselves by identifying some
subset of image information from a larger set of image information presented on
a display. Graphical passwords are often categorized as a recognition-based
method as opposed to traditional recall-based methods, such as PINs and text
passwords [1]. Humans have a high aptitude to distinguish and process
information in images, and thus recall-based methods have the potential to
provide accurate and user-friendly authentication. Additionally, graphical
passwords are also thought to be harder to defeat by some members of the
security community. Unfortunately, some of the early graphical password systems
were also quite vulnerable to shoulder-surfing attacks. Since all visual
information is presented onscreen, any input methods that directly indicate the
user’s action onscreen (e.g. using the mouse to point to the correct image)
make it quite simple for a shoulder-surfer to defeat the system. Tari et al.
introduced the Passfaces system to try to combat shoulder-surfing [2]. Results
from this study showed improved capability of defeating shoulder-surfing by
mapping image selection from a 3x3 grid to a number pad entry (1-9) method.
Humans were generally unable to observe both the graphical images presented on
screen and the user keyboard input simultaneously. However, the Passfaces
system was not tested against any sort of electronic (camera or video) based
shoulder-surfing attack.
The work described in this paper aims to identify the severity of the
vulnerability that camera and video recording pose to systems such as Passfaces
while introducing a new method of authentication that deters such attacks. The
proliferation of camera and video enabled cell phones greatly increases this
threat as shoulder-surfing can be made less invasive, automated, and anonymous.
A not too farfetched scenario may include an attacker using a cell phone behind
someone in an ATM line. The attacker can act as if he is using his cell phone
to dial a call or write a text message (looking unassuming to the ATM user),
while instead he can be taking photos or video recording the user’s entire ATM
session. An automated attack with a remote camera is equally disconcerting.
In a graphical password system, there should be great care in trying to
decouple the presentation of visual information from user input indicating
response to the presented information. For example, in the Passfaces system if
it is possible to hide the keyboard from an attacker during user input, it
would reduce the likelihood of defeating the system. Likewise, hiding the
visual information presented on screen from the attacker would also reduce the
likelihood of defeating the system. If an attacker possesses only the
keystrokes of the user, they have no visual information to match it against
(especially since the positions of faces in the Passfaces grid randomizes every
session). If the attacker possesses only the presented visual information, they
will be unable to determine what the user selected to authenticate themselves
(however, a determined attacker may be able to use visual information collected
from several authentication sessions of the same user to defeat the system). An
ideal system would hide both the visual information and the method of input
from an attacker.
Our proposed system utilizes the difficulty with which cameras and video
recording devices have in adjusting critical settings (focus, aperture, shutter
speed, white balance, ISO, etc.) in reaction to a scene in which the amount of
