A NOVEL GRAPHICAL

PASSWORD
AUTHENTICATION
1
A Shashidhar Reddy, 2B Vinuthna, 3A Mounika, 4K Sri Gowtami

Computer Science and Engineering (AI &ML) Department, Malla Reddy Engineering
College, Maisammaguda, Secundrabad, Telangana, India-500100
1
[email protected]
2
[email protected]
3
[email protected]
4
[email protected]

Abstract: Humans tend to recall pictures more graphical password system, which operates through a
effectively than text. This observation suggests that Graphical Password Interface (GUI), allowing users to
graphical authentication passwords could serve as select specific images in a predetermined sequence
viable alternatives to text-based passwords. The instead of relying on alphanumeric characters. This
primary aim of this research is to assess the usability approach aims to mitigate the common weaknesses and
characteristics of recognition-based graphical vulnerabilities inherent in traditional alphanumeric
passwords, taking into account both ISO standards techniques while also enhancing password security and
and general usability attributes. Subsequently, these memorability.
usability attributes and their sub-features were
compared to identify potential enhancements, which The underlying premise behind graphical passwords
were then incorporated into a novel graphical is twofold: firstly, users tend to find it easier to
password scheme. A prototype of the proposed memorize images compared to alphanumeric characters,
scheme was developed, and a usability evaluation and secondly, these images can serve as effective
was conducted to gauge its effectiveness and substitutions for traditional passwords. Despite the
practicality as an alternative user authentication emergence of alternative authentication methods like
method. According to the results of the biometrics and smart cards, passwords remain the
questionnaire survey and user feedback regarding primary mode of authentication. However, traditional
the entire system and the usability attributes of the passwords are not without their flaws, as insecure
proposed scheme, all percentages of findings were password choices can compromise security and provide
reported to be very positive. This suggests that from avenues for attackers.
a usability standpoint, the new graphical password In the realm of graphical password research, usability
scheme is highly acceptable. plays a pivotal role. Usability, as defined by the ISO
9241-11 standard, is essential for ensuring that a product
Index Terms: Graphical authentication passwords, enables users to achieve their objectives efficiently,
ISO standards, General usability attributes effectively, and satisfactorily within a given context.
Usability evaluation, Novel graphical password Despite the emphasis on security enhancements in
scheme graphical user authentication, usability features have
often been overlooked. Many researchers have
I. INTRODUCTION concentrated their efforts on proposing new algorithms
or improving existing ones to enhance security,
Security requirements are increasingly crucial for
neglecting the critical aspect of user satisfaction and
computer systems due to the expanding threat landscape,
usability.
necessitating robust solutions. One such solution is a
 Consequently, this study seeks to address this gap by 86.This survey explores the landscape of graphical
developing a novel graphical password scheme that authentication technologies, including graphical
prioritizes usability features. By focusing on aspects such passwords, gesture-based authentication, and other
as password memorization ease, user satisfaction, and visual authentication methods, providing insights into
happiness, this scheme aims to provide a more user- their usability and security aspects.
friendly and secure authentication solution. Through
rigorous evaluation and testing, the proposed scheme III. PROPOSED MODEL
aims to demonstrate its effectiveness in meeting users' The design incorporates various strategies and
needs while enhancing overall security. technologies to improve user engagement and
II. LITERATURE SURVEY functionality.
[1]Jermyn, I., Mayer, A., Monrose, F., Reiter, M. K., & A. Interface Design:
Rubin, A. D. (1999). The Design and Analysis of The graphical user interface (GUI) plays a crucial
Graphical Passwords. In Proceedings of the 8th role in facilitating user-system interaction. In this model,
USENIX Security Symposium (pp. 1-14). USENIX the GUI is situated on the client-side, directly engaging
Association.This seminal paper introduces the concept users and facilitating communication with the server and
of graphical passwords and presents an analysis of their database management system. HTML/CSS is employed
design and security implications, laying the groundwork for static elements, while JavaScript enables dynamic
for subsequent research in the field. features like drag and drop functionality.
The "Registration" page serves as the entry point for
[2]Wiedenbeck, S., Waters, J., Birget, J. C., Brodskiy, users. Here, users input general information and select a
A., & Memon, N. (2005). PassPoints: Design and username. A 4x8 table displays images of well-known
longitudinal evaluation of a graphical password system. personalities, allowing users to select at least six images
International Journal of Human-Computer Studies, to form their graphical password. The drag and drop
63(1-2), 102-127.This study presents PassPoints, a feature enables users to arrange these images in any
graphical password system, and provides a longitudinal order within a designated string. To enhance usability
evaluation of its usability and security, highlighting the and security, selected images during login sessions are
importance of considering both aspects in password displayed with reduced opacity to mitigate shoulder-
authentication systems. surfing attacks.
[3]Dunphy, P., Yan, J., & Vargas, L. (2010). A
B. Registration and Log-in Interface:
comparative study of usability in graphical and textual
passwords. In Proceedings of the 6th Symposium on
Usable Privacy and Security (SOUPS 2010) (pp. 5:1– The proposed scheme comprises two stages: registration
5:12). ACM.This research compares the usability of and authentication.
graphical and textual passwords, shedding light on user Registration Interface (New User):
preferences and challenges associated with each
authentication method. Users select images to create their graphical password,
which can be a combination of images and spaces without
[4]Biddle, R., Chiasson, S., & van Oorschot, P. C. any specific order. Error messages prompt users to complete
(2012). Graphical passwords: Learning from the first required fields or select a sufficient number of images. Upon
twelve years. ACM Computing Surveys (CSUR), 44(4), successful registration, a confirmation message allows users
19.This survey paper provides an overview of graphical to proceed to the "Signing-In" page.
password research, including usability studies, security Log-In Interface (Existing User):
analyses, and design considerations, offering insights
into the evolution of graphical password systems. The "Signing-In" page enables registered users to log in
using their username and graphical password. Error
[5]Alsulaiman, M., & Saddik, A. E. (2017). A survey of messages are displayed for incorrect credentials. Successful
graphical password schemes. Journal of Network and login redirects users to the main page, while incorrect
Computer Applications, 79, 1-26.This comprehensive credentials prompt an error message.
survey reviews various graphical password schemes
proposed in the literature, discussing their strengths, In summary, the proposed model enhances user
weaknesses, and applicability in different contexts. interaction and usability through intuitive interface design
and streamlined registration and login processes.
[6]Renaud, K., & Thorpe, J. (2017). A Survey of
Graphical Authentication Technology. Information
Security Journal: A Global Perspective, 26(2), 66-
 [Figure 2: Registration Error Messages]
(link_to_registration_error_screenshot)
III. IMPLEMENTATION
This project aims to enhance usability and security in
graphical password authentication systems. The
implementation employs the following components and
methodologies:
a) Graphical User Interface (GUI):
The graphical user interface (GUI) is pivotal for user-
system interaction. Implemented on the client-side, it
facilitates communication with users and the server,
particularly the database management system. The GUI
is developed using HTML/CSS for static elements and
JavaScript for dynamic features like drag and drop
functionality.

Figure 3: Signing-In Page Interface

Error Handling:
Error handling mechanisms are integrated into both
the registration and log-in interfaces to provide users
with informative feedback in case of incorrect inputs or
incomplete fields. Error messages are displayed
prominently, guiding users to rectify their inputs and
successfully complete the registration or log-in process.
Deployment and Impact:
The implementation of this graphical password
authentication system aims to provide a user-friendly and
secure authentication solution. By prioritizing usability
and security, the system enhances accessibility and
Figure1:Registration Page Interface
inclusivity in user authentication processes.

Figure 1 illustrates the "Registration" page interface,

featuring fields for user information and a 4x8 table for
selecting images as passwords. The drag and drop
feature simplifies password creation, while reduced
opacity during login sessions enhances security.
b) Registration and Log-in Interface:
The proposed scheme comprises two stages:
registration and authentication.
1.Registration Interface (New User):
Users select images to create their graphical
password, as depicted in Fig 2. Error messages prompt
users to complete required fields or select a sufficient
number of images. Upon successful registration, users
receive a confirmation message and are redirected to the
"Signing-In" page.
2. Log-In Interface (Existing User):
The "Signing-In" page enables registered users to log
in using their username and graphical password, as
illustrated in Fig 3. Error messages prompt users for
incorrect credentials, redirecting them upon successful
login. Incorrect credentials prompt an error message.
 IV. RESULTS AND DISCUSSION means of creating and managing graphical passwords.

One of the system's notable strengths is its robust security

measures, including the integration of reduced opacity for
selected images during login sessions. This feature
significantly reduces the risk of unauthorized access attempts,
thereby enhancing overall system security.

However, like any system, there are areas for potential

improvement. While the implemented error handling
mechanisms effectively guide users through the registration
and log-in processes, further refinement may be required to
address edge cases and enhance user experience.

Overall, the results underscore the promising potential of the

developed graphical password authentication system in
providing a secure and user-friendly alternative to traditional
alphanumeric passwords. Future research may focus on
The developed graphical password authentication system
refining the system's usability features and further enhancing
effectively enhances usability and security, catering to the
its security measures to meet evolving user needs and
needs of users seeking an alternative to traditional
technological advancements.
alphanumeric passwords. The system's key features and
outcomes are summarized below:
1. Usability Enhancement:
- The user interface (UI) design, implemented using
REFERENCE
HTML/CSS and JavaScript, ensures intuitive interaction and
navigation for users. [1]. Jermyn, I., Mayer, A., Monrose, F., Reiter, M.
- Incorporation of the drag and drop functionality simplifies K., & Rubin, A. D. (1999). The design and analysis
the password creation process, offering users a seamless and of graphical passwords. In Proceedings of the 8th
user-friendly experience. USENIX Security Symposium (pp. 1-14).
- Error handling mechanisms effectively guide users through
the registration and log-in processes, minimizing user errors [2]. Biddle, R., Chiasson, S., & van Oorschot, P.
and enhancing overall usability. C. (2012). Graphical passwords: Learning from
the first twelve years. ACM Computing Surveys
2. Security Measures: (CSUR), 45(4), 1-38.
- Integration of reduced opacity for selected images during
login sessions mitigates the risk of shoulder-surfing attacks, [3]. Sae-Bae, N., Sheppard, J., & Camp, L. J.
enhancing system security. (2014). A field study of knowledge retention in
- Error handling for incorrect credentials ensures prompt graphical passwords. In Proceedings of the 32nd
identification of unauthorized access attempts, bolstering Annual ACM Conference on Human Factors in
security measures. Computing Systems (pp. 2639-2648).

3. Efficient Registration and Log-in Processes: [4]. Thorpe, J., & van Oorschot, P. C. (2005).
- Successful completion of registration and log-in processes Human-seeded attacks and exploiting hot spots in
by users demonstrates the effectiveness of the implemented graphical passwords. In International Conference
interfaces and functionalities. on Financial Cryptography and Data Security (pp.
- Minimal instances of registration errors and failed log-in 127-141). Springer, Berlin, Heidelberg.
attempts indicate smooth and efficient user interactions with
the system. [5]. Wiedenbeck, S., Waters, J., Birget, J. C.,
Brodskiy, A., & Memon, N. (2005). PassPoints:
Discussion: Design and longitudinal evaluation of a graphical
password system. International Journal of
The results obtained from the implementation highlight the Human-Computer Studies, 63(1-2), 102-127.
effectiveness of the proposed graphical password
authentication system in achieving the project objectives of [6]. Dunphy, P., Yan, J., Zhang, Q., & Weng, S.
enhancing usability and security. By leveraging innovative UI F. (2015). Investigating the memorability of
design and features such as drag and drop functionality, the graphical passwords: A case study with Chinese
system provides users with a straightforward and efficient users. International Journal of Human-Computer
Interaction, 31(12), 899-913.

[7]. Lee, S., & Bellovin, S. M. (2013). Deja Vu:

A user study using images for authentication. In
Proceedings of the Symposium on Usable Privacy
and Security (SOUPS) (pp. 1-13).

[8]. Blonder, G. E. (1996). System and method

for authenticating users in a computer network.
U.S. Patent No. 5,802,110. Washington, DC: U.S.
Patent and Trademark Office.

[9]. Sonia, K. S., Shobana, L., & Ramaraj, N.

(2017). A Survey on Graphical Password
Authentication Techniques. Procedia Computer
Science, 115, 206-213.

[10]. Yan, J., Blackwell, A. F., Anderson, R., &

Grant, A. (2004). The memorability and security
of passwords—some empirical results. In
Proceedings of the 2004 ACM Workshop on
Computer Security (pp. 17-26).

[11]. Vishwanath, A., & Herley, C. (2011). Homo

numericus: On graphical and numerical password
strengths. In 2011 IEEE Symposium on Security
and Privacy (pp. 173-188).

[12]. Thorpe, J., Oorschot, P. C., & Somayaji, A.

(2007). Passwords and the evolution of imperfect
authentication. Communications of the ACM,
50(9), 126-131.

[13]. Forget, A., Chiasson, S., & Biddle, R.

(2008). Persuasion for stronger passwords:
motivation and pilot study. In Proceedings of the
2008 Symposium on Usable Privacy and Security
(pp. 45-56).

[14]. Liao, I. E., & Kuo, C. H. (2017). A Survey

of Graphical Password Authentication.
International Journal of Information
Management, 37(2), 87-100.

[15]. Wiedenbeck, S., Waters, J., & Birget, J. C.

(2006). Design and evaluation of a shoulder-
surfing resistant graphical password scheme. In
Proceedings of the working conference on
Advanced visual interfaces (pp. 177-184).