The Role of Visual Coherence in Graphical Passwords

The Role of Visual Coherence in Graphical Passwords Ulku Arslan Aydin 1 (ulku.arslan@gmail.com) Cengiz Acarturk 1 (acarturk@metu.edu.tr) Kursat Cagiltay 2 (kursat@metu.edu.tr) Cognitive Science, Informatics Institute Computer Education and Instructional Technology Middle East Technical University, 06800, Ankara, Turkey systems (Herley et al., 2009). An alternative knowledge- based authentication method, namely graphical passwords, has been recently gaining an increased use. Abstract Graphical password is an alternative method of authentication to alphanumerical passwords. From the perspective of research on human memory, it is yet another novel technology that introduces challenges on human memory components. In this study, we aim to investigate the previous findings in human visual memory in the domain of graphical passwords by analyzing the role of visual coherence in passwords. The results of an experimental study reveal that in terms of memorability, coherent images are better candidates as graphical password images than jumbled images. Graphical Passwords as an Alternative Method to Alphanumerical Passwords Keywords: Graphical passwords; visual coherence, visual working memory, eye tracking. Knowledge-Based Authentication Systems The extended use of human computer interfaces in the past few decades has introduced several challenges on users’ working memory. One such challenge is the requirement to memorize numerous passwords for security authentication. From the viewpoint of information security, user access to a security system is granted in three phases: identification, authentication and authorization (Figure 1). After identification, the user supplies the proof of her/his identity in the authentication phase. The proof of identity is usually accomplished by employing methods such as using a smartcard (token-based authentication), using biometric information such as fingerprints (biometric-based authentication), or entering an alphanumeric or a graphical password (knowledge-based authentication). Graphical passwords were developed to overcome some of the security issues involved in the use of alphanumeric passwords (Dunphy et al., 2008). Graphical passwords are of different types, such as recall-based, recognition-based, and click-based (Figure 2). In a click-based graphical password system, a pixel-based image acts as a cue for activating user’s memory. When creating a password in a click-based system, the user selects a sequence of number of (e.g., four or five) points on the presented image. After then, to login the system, the user reselects the points on the image in the same order by clicking on (or near to) them (Blonder, 1996; Wiedenbeck et al., 2005; Chiasson et al., 2007; Chiasson, 2008). Figure 2: Sample graphical passwords (Dhamija & Perrig, 2000, Lashkari et al., 2009; Valentine, 1999). From the end-user’s point of view, the major motivation for the development of graphical passwords was to take the advantage of picture memorability over text while maintaining security (Wiedenbeck, et al., 2005), thus providing a solution to the security-usability dilemma. 1 The motivation for the development of graphical passwords finds its roots in early studies in cognitive psychology research, which revealed that humans have a tendency to Figure 1: A taxonomy of authentication methods in information security systems. Recently, knowledge-based authentication methods—in particular, text-based, alphanumerical passwords—are largely used for information access in information security 1 The security- usability dilemma refers to the observation that “passwords are often either memorable-but-insecure or secure-but- difficult-to-remember” Chiasson, 2008, p. 3. Graphical passwords as a solution to the dilemma are beyond the scope of this study.