Abstract
Authorized access to resources by legitimate users plays a crucial role in providing a secure and hassle-free user experience in the digital environments. Password remains the major authentication mechanism though there exist various drawbacks like leakage due to phishing and shoulder surfing, etc. This paper proposes two stronger transformations of the password termed as “PassContext” and “PassActions” which attempts to overcome the vulnerabilities in the plain-text password by harnessing the intricacies of human–computer interaction. The PassContext incorporates the hardware and software oriented context information along with the keyed-in password text during the verification process to provide improved authentication. The PassActions transforms the password from being text-only representation into a dynamic user interaction sequence which improves the strength of the password significantly. The proposed model incorporates methodologies to represent PassContext and PassActions for both validation and persistence purposes. The prototype implementations of PassContext and PassActions are evaluated with a suit of thirteen proposed measures, system usability survey (SUS) for usability analysis and with a well-established comparative framework.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Alnfiai M, Sampalli S (2018) Braillepassword: accessible web authentication technique on touchscreen devices. J Ambient Intell Hum Comput. https://doi.org/10.1007/s12652-018-0860-x
Bartlow N, Cukic B (2009) Keystroke dynamics-based credential hardening systems. In: Handbook of remote biometrics, Springer, New York, pp 329–347, http://link.springer.com/chapter/10.1007/978-1-84882-385-3_14
Bertoni G, Daemen J, Peeters M, Van Assche G (2011) The keccak sha-3 submission. Submiss NIST (Round 3) 6(7):16
Bhattacharyya D, Ranjan R, Alisherov F, Choi M (2009) Biometric authentication: a review. Int J u- e-Serv Sci Technol 2(3):13–28, http://www.researchgate.net/profile/Debnath_Bhattacharyya/publication/46189709_Biometric_Authentication_A_Review/links/09e4150ff1c2ef3463000000.pdf
Biddle R, Mannan M, van Oorschot P, Whalen T (2011) User study, analysis, and usable security of passwords based on digital objects. IEEE Trans Inf Forensics Secur 6(3):970–979. https://doi.org/10.1109/TIFS.2011.2116781
Biddle R, Chiasson S, Van Oorschot P (2012) Graphical passwords: learning from the first twelve years. ACM Comput Surv 44(4):19:1–19:41. https://doi.org/10.1145/2333112.2333114
Blaica B, Vladui D, Mladeni D (2013) MTi: a method for user identification for multitouch displays. Int J Hum Comput Stud 71(6):691–702. https://doi.org/10.1016/j.ijhcs.2013.03.002
Bonneau J, Herley C, Oorschot PCv, Stajano F (2012) The quest to replace passwords: a framework for comparative evaluation of web authentication schemes. In: Proceedings of the 2012 IEEE symposium on security and privacy, IEEE computer society, Washington, DC, USA, SP ’12, pp 553–567. https://doi.org/10.1109/SP.2012.44
Bours P (2012) Continuous keystroke dynamics: a different perspective towards biometric evaluation. Inf Secur Tech Rep 17(12):36–43. https://doi.org/10.1016/j.istr.2012.02.001. http://www.sciencedirect.com/science/article/pii/S1363412712000027
Bowyer KW, Hollingsworth K, Flynn PJ (2008) Image understanding for iris biometrics: a survey. Comput Vis Image Underst 110(2):281–307 (pii: S1077314207001373)
Brainard J, Juels A, Rivest RL, Szydlo M, Yung M (2006) Fourth-factor Authentication: Somebody You Know. In: Proceedings of the 13th ACM conference on computer and communications security, ACM, New York, NY, USA, CCS ’06, pp 168–178. https://doi.org/10.1145/1180405.1180427
Brooke J (1986) System usability scale (sus): a quick-and-dirty method of system evaluation user information. Digital Equipment Co Ltd, Reading
Catuogno L, Galdi C (2014) Analysis of a two-factor graphical password scheme. Int J Inf Secur 13(5):421–437. https://doi.org/10.1007/s10207-014-0228-y
Clarke N, Furnell S (2005) Biometrics The promise versus the practice. Comput Fraud Securi 9:12–16. https://doi.org/10.1016/S1361-3723(05)70253-0. http://www.sciencedirect.com/science/article/pii/S1361372305702530
Das A, Bonneau J, Caesar M, Borisov N, Wang X (2014) The tangled web of password reuse. In: Symposium on network and distributed system security (NDSS). http://janhkrueger.de/gitpup/RSSArtikel/raw/84d8806a94c322c4632893686b9fbf034493ab6f/The_Tangled_Web_of_Password_Reuse.pdf
Dhamija R, Dusseault L (2008) The seven flaws of identity management: usability and security challenges. IEEE Secur Priv 6(2):24–29. https://doi.org/10.1109/MSP.2008.49
Duggan GB, Johnson H, Grawemeyer B (2012) Rational security: modelling everyday password use. Int J Hum Comput Stud 70(6):415–431. https://doi.org/10.1016/j.ijhcs.2012.02.008
Florencio D, Herley C (2007) A large-scale study of web password habits. In: Proceedings of the 16th international conference on world wide web, ACM, New York, NY, USA, WWW ’07, pp 657–666. https://doi.org/10.1145/1242572.1242661
Fridman L, Stolerman A, Acharya S, Brennan P, Juola P, Greenstadt R, Kam M (2015) Multi-modal decision fusion for continuous authentication. Comput Electric Eng 41:142–156. https://doi.org/10.1016/j.compeleceng.2014.10.018
Gibbs MD (2010) Biometrics: body odor authentication perception and acceptance. ACM SIGCAS Comput Soc 40(4):16–24, http://dl.acm.org/citation.cfm?id=1929612
Gudavalli M, Raju SV, Kumar DS, others (2012) Multimodal BiometricsSources, architecture and fusion techniques: an overview. In: 2012 international symposium on biometrics and security technologies (ISBAST), IEEE, pp 27–34, http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=6189658
Gyorffy JC, Tappenden AF, Miller J (2011) Token-based graphical password authentication. Int J Inf Secur 10(6):321–336. https://doi.org/10.1007/s10207-011-0147-0
Herley C, Oorschot PCV, Patrick AS (2009) Passwords: if were so smart, why are we still using them? In: Dingledine R, Golle P (eds) Financial cryptography and data security, no. 5628 in lecture notes in computer science, Springer, Berlin, pp 230–237. https://doi.org/10.1007/978-3-642-03549-4_14
Internet Security Threat Report 2015 | Symantec (2015). http://www.symantec.com/security_response/publications/threatreport.jsp
Irvine JM, Israel SA, Scruggs WT, Worek WJ (2008) eigenPulse: robust human identification from cardiovascular function. Pattern Recognit 41(11):3427–3435 (pii: S0031320308001660)
Jagadeesan H, Hsiao MS (2009) A novel approach to design of user re-authentication systems. In: IEEE 3rd international conference on biometrics: theory, applications, and systems, 2009. BTAS’09. IEEE, pp 1–6, http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=5339075
Jang-Jaccard J, Nepal S (2014) A survey of emerging threats in cybersecurity. J Comput Syst Sci 80(5):973–993. https://doi.org/10.1016/j.jcss.2014.02.005
Jermyn I, Mayer AJ, Monrose F, Reiter MK, Rubin AD, others (1999) The design and analysis of graphical passwords. In: Usenix security, https://www.usenix.org/legacy/events/sec99/full_papers/jermyn/jermyn.pdf
Kang P, Park S, Ss Hwang, Hj Lee, Cho S (2008) Improvement of keystroke data quality through artificial rhythms and cues. Computers & Security 27(12):3–11. https://doi.org/10.1016/j.cose.2008.02.001, http://www.sciencedirect.com/science/article/pii/S0167404808000023
Keith M, Shao B, Steinbart PJ (2007) The usability of passphrases for authentication: an empirical field study. Int J Hum Comput Stud 65(1):17–28. https://doi.org/10.1016/j.ijhcs.2006.08.005
KidLogger (2014) Freeware and open source Parental Controls for Windows, Mac, Android. Keylogger. http://kidlogger.net/. Accessed 2 Dec 2017
Kuber R, Yu W (2010) Feasibility study of tactile-based authentication. International Journal of Human-Computer Studies 68(3):158–181. https://doi.org/10.1016/j.ijhcs.2009.11.001, http://www.sciencedirect.com/science/article/pii/S1071581909001608
Kumar T, Raghavan S (2008a) Mobile PassPattern System (MPPS) advanced user authentication system for mobile devices. In: Wireless days, 2008. WD ’08. 1st IFIP, pp 1–5. https://doi.org/10.1109/WD.2008.4812893
Kumar TR, Raghavan SV (2008b) PassPattern System (PPS): a pattern-based user authentication scheme. In: Das A, Pung HK, Lee FBS, Wong LWC (eds) NETWORKING 2008 ad hoc and sensor networks, wireless networks, next generation internet, no. 4982 in lecture notes in computer science, Springer, Berlin, pp 162–169. https://doi.org/10.1007/978-3-540-79549-0_14
Lamiche I, Bin G, Jing Y, Yu Z, Hadid A (2018) A continuous smartphone authentication method based on gait patterns and keystroke dynamics. J Ambient Intell Humaniz Comput. https://doi.org/10.1007/s12652-018-1123-6
Mario RI, lvarez HF, Encinas LH (2012) A crypto-biometric scheme based on iris-templates with fuzzy extractors. Inf Sci 195:91–102. https://doi.org/10.1016/j.ins.2012.01.042
Nali D, Thorpe J (2004) Analyzing user choice in graphical passwords. School of Computer Science, Carleton University, Technical Report TR-04-01 http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.85.998&rep=rep1&type=pdf
Nauman M, Ali T, Rauf A (2013) Using trusted computing for privacy preserving keystroke-based authentication in smartphones. Telecommunication Systems 52(4):2149–2161, http://link.springer.com/article/10.1007/s11235-011-9538-9
Nithyanand R, Johnson R (2013) The password allocation problem: strategies for reusing passwords effectively. In: Proceedings of the 12th ACM workshop on workshop on privacy in the electronic society, ACM, New York, NY, USA, WPES ’13, pp 255–260, https://doi.org/10.1145/2517840.2517870
Paivio A (2014) Mind and its evolution: a dual coding theoretical approach. Psychology Press, London. https://books.google.co.in/books?hl=en&lr=&id=FaGYAgAAQBAJ&oi=fnd&pg=PP1&dq=PAIVIO,+A.+2006.+Mind+and+Its+Evolution:+A+Dual+Coding+Theoretical+Approach&ots=FabaWtFY1z&sig=41m9aE-EE7kVf5tD7PNO1KCMb3A
Pusara M, Brodley CE (2004) User re-authentication via mouse movements. In: Proceedings of the 2004 ACM workshop on visualization and data mining for computer security, ACM, pp 1–8. http://dl.acm.org/citation.cfm?id=1029210
Sasse MA, Brostoff S, Weirich D (2001) Transforming the ’Weakest Link’ a human/computer interaction approach to usable and effective security. BT Technol J 19(3):122–131. https://doi.org/10.1023/A:1011902718709
Schechter S, Egelman S, Reeder RW (2009) It’s not what you know, but who you know: a social approach to last-resort authentication. In: Proceedings of the SIGCHI conference on human factors in computing systems, ACM, New York, NY, USA, CHI ’09, pp 1983–1992. https://doi.org/10.1145/1518701.1519003
Senk C, Dotzler F (2011) Biometric authentication as a service for enterprise identity management deployment: a data protection perspective. In: 2011 Sixth international conference on availability, reliability and security (ARES), pp 43–50. https://doi.org/10.1109/ARES.2011.14
Seward ZM, Sun A (2010) The Top 50 Gawker media passwords. Wall Str J
Sharma G, Kalra S (2019) Advanced lightweight multi-factor remote user authentication scheme for cloud-iot applications. J Ambient Intell Humaniz Comput. https://doi.org/10.1007/s12652-019-01225-1
Shay R, Bertino E (2009) A comprehensive simulation tool for the analysis of password policies. Int J Inf Secur 8(4):275–289. https://doi.org/10.1007/s10207-009-0084-3
Stobert E (2014) The agony of passwords: can we learn from user coping strategies? In: CHI ’14 extended abstracts on human factors in computing systems, ACM, New York, NY, USA, CHI EA ’14, pp 975–980. https://doi.org/10.1145/2559206.2579421
Tafasa \(\text{::}\) PatternLock (2011). http://www.tafasa.com/patternlock.html. Accessed 2 Dec 2017
Taiabul Haque SM, Wright M, Scielzo S (2014) Hierarchy of users web passwords: Perceptions, practices and susceptibilities. International Journal of Human-Computer Studies 72(12):860–874. https://doi.org/10.1016/j.ijhcs.2014.07.007, http://www.sciencedirect.com/science/article/pii/S1071581914001037
Tao H, Adams C (2008) Pass-Go: a proposal to improve the usability of graphical passwords. IJ Netw Secur 7(2):273–292, http://ijns.jalaxy.com.tw/contents/ijns-v7-n2/ijns-2008-v7-n2-p273-292.pdf
Teh PS, Teoh ABJ, Tee C, Ong TS (2010) Keystroke dynamics in password authentication enhancement. Expert Syst Appl 37(12):8618–8627. https://doi.org/10.1016/j.eswa.2010.06.097
Teh PS, Teoh ABJ, Yue S (2013) A survey of keystroke dynamics biometrics. The Scientific World Journal 2013, http://www.hindawi.com/journals/tswj/aip/408280/
Unar JA, Seng WC, Abbasi A (2014) A review of biometric technology along with trends and prospects. Pattern Recognit 47(8):2673–2688. https://doi.org/10.1016/j.patcog.2014.01.016
Usha K, Ezhilarasan M (2015) Finger knuckle biometrics a review. Comput Electric Eng 45:249–259. https://doi.org/10.1016/j.compeleceng.2014.11.008
Varenhorst C, Kleek MV, Rudolph L (2004) Passdoodles: a lightweight authentication method. Res Sci Instit http://people.csail.mit.edu/emax/public_html/papers/varenhorst.pdf
Virvilis N, Mylonas A, Tsalis N, Gritzalis D (2015) Security Busters: Web browser security vs. rogue sites. Computers & Security 52:90–105. https://doi.org/10.1016/j.cose.2015.04.009, http://www.sciencedirect.com/science/article/pii/S0167404815000590
Vu KPL, Proctor RW, Bhargav-Spantzel A, Tai BLB, Cook J, Eugene Schultz E (2007) Improving password security and memorability to protect personal and organizational information. Int J Hum Comput Stud 65(8):744–757. https://doi.org/10.1016/j.ijhcs.2007.03.007
Wiedenbeck S, Waters J, Birget JC, Brodskiy A, Memon N (2005a) Authentication using graphical passwords: effects of tolerance and image choice. In: Proceedings of the 2005 symposium on usable privacy and security, ACM, New York, NY, USA, SOUPS ’05, pp 1–12, https://doi.org/10.1145/1073001.1073002
Wiedenbeck S, Waters J, Birget JC, Brodskiy A, Memon N (2005b) PassPoints: design and longitudinal evaluation of a graphical password system. Int J Hum Comput Stud 63(12):102–127. https://doi.org/10.1016/j.ijhcs.2005.04.010
Wiedenbeck S, Waters J, Sobrado L, Birget JC (2006) Design and evaluation of a shoulder-surfing resistant graphical password scheme. in: Proceedings of the working conference on advanced visual interfaces, ACM, New York, NY, USA, AVI ’06, pp 177–184, https://doi.org/10.1145/1133265.1133303
Wu F, Xu L, Kumari S, Li X (2015) A novel and provably secure biometrics-based three-factor remote authentication scheme for mobile clientserver networks. Comput Electric Eng 45:274–285. https://doi.org/10.1016/j.compeleceng.2015.02.015
Wu TS, Lee ML, Lin HY, Wang CY (2013) Shoulder-surfing-proof graphical password authentication scheme. Int J Inf Secur 13(3):245–254. https://doi.org/10.1007/s10207-013-0216-7
Xu D, Chen J, Liu Q (2019) Provably secure anonymous three-factor authentication scheme for multi-server environments. J Ambient Intell Humaniz Comput 10(2):611–627. https://doi.org/10.1007/s12652-018-0710-x
Yan J, Blackwell A, Anderson R, Grant A (2004) Password memorability and security: empirical results. IEEE Secur Priv 2(5):25–31. https://doi.org/10.1109/MSP.2004.81
Yuan L, Chun MZ (2012) Ear recognition based on local information fusion. Pattern Recognit Lett 33(2):182–190 (pii: S0167865511003400)
Zhang D, Liu Z, Yan JQ (2010) Dynamic tongueprint: a novel biometric identifier. Pattern Recognit 43(3):1071–1082 (pii: S0031320309003392)
Zhang L, Zhang L, Zhang D, Guo Z (2012) Phase congruency induced local features for finger-knuckle-print recognition. Pattern Recognit 45(7):2522–2531 (pii: S0031320312000386)
Zhu B, Fan X, Gong G (2015) Pleco and Plectron two provably secure password hashing algorithms. In: Proceedings of the 5th ACM conference on data and application security and privacy, ACM, New York, NY, USA, CODASPY ’15, pp 127–129. https://doi.org/10.1145/2699026.2699125
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
About this article
Cite this article
Kuppusamy, K.S. PassContext and PassActions: transforming authentication into multi-dimensional contextual and interaction sequences. J Ambient Intell Human Comput 11, 1467–1494 (2020). https://doi.org/10.1007/s12652-019-01336-9
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s12652-019-01336-9