Vol. 8, No. 7, 2017 A Text Based Authentication Scheme For .

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 8, No. 7, 2017A Text based Authentication Scheme for ImprovingSecurity of Textual PasswordsShah Zaman NizamaniTariq Jamil KhanzadaDepartment of Information TechnologyQuaid-e-Awam University of Engineering, Science &Technology, PakistanDepartment of Computer Systems EngineeringMehran University of Engineering & Technology, PakistanSyed Raheel HassanMohd Zalisham JaliDepartment of Computer Systems EngineeringQuaid-e-Awam University of Engineering, Science &Technology, PakistanFaculty of Science and TechnologyUniversiti Sains Islam (USIM), MalaysiaAbstract—User authentication through textual passwords isvery common in computer systems due to its ease of use. Howevertextual passwords are vulnerable to different kinds of securityattacks, such as spyware and dictionary attacks. In order toovercome the deficiencies of textual password scheme, manygraphical password schemes have been proposed. The proposedschemes could not fully replace textual passwords, due to usabilityand security issues. In this paper a text based user authenticationscheme is proposed which improves the security of textualpassword scheme by modifying the password input method andadding a password transformation layer. In the proposed schemealphanumeric password characters are represented by randomdecimal numbers which resist online security attacks such asshoulder surfing and key logger attacks. In the registration process password string is converted into a completely new string ofsymbols or characters before encryption. This strategy improvespassword security against offline attacks such as brute-force anddictionary attacks. In the proposed scheme passwords consistof alphanumeric characters therefore users are not required toremember any new kind of passwords such as used in graphicalauthentication. Hence password memorability burden has beenminimized. However mean authentication time of the proposedscheme is higher than the textual password scheme due to thesecurity measures taken for the online attacks.Keywords—Password security; security; usability; alphanumericpasswords; authenticationI.I NTRODUCTIONDespite of many weaknesses user authentication throughtextual passwords is widely used since long time. In textualpassword scheme credentials are directly inserted into loginfields, which results in easy capture of password throughspyware attack, and shoulder Surfing attack [1]. Other problemwith textual password scheme is that users tend to set shortand easy to remember passwords, such passwords are easy tobreak through brute force or dictionary attack [2]. Thereforeusers are restricted to add numbers or special characters intheir passwords but such policies make the passwords hard toremember.By recognizing the memorability and security issues in textual passwords, researchers proposed different graphical password techniques. In this category of authentication passwordsare consist of some pictures, lines or x, y coordinates insidea picture. Generally graphical passwords have memorabilityadvantage over textual passwords because visual informationis easy to remember and recall than alphanumeric characters[3] [4]. While security and usability of graphical passwordtechniques varies from one scheme to another.Graphical password technique was first proposed by Blonder [5] in 1996, since then many graphical password techniquesare proposed but none has replaced textual password scheme.Shoulder surfing and spyware attacks are common threat todifferent graphical password schemes. Android unlock scheme[6], is the only graphical password scheme being largelyused in smart phones because the scheme is easy to use.Although this technique has many security weaknesses suchas shoulder surfing attack but due to nature of the device,attackers have very little access to launch security attacks. Dueto security weaknesses Android unlock scheme is not used inonline systems for authentication. Secure graphical passwordschemes have timing and adoptability issues. Such schemesrequire large amount of physical and mental work to do forauthentication and users have to remember different kinds ofpasswords that is why many usability issues arises.User authentication can be made secure by biometric ortoken based authentication techniques but they require specialhardware for processing. The other easy to use authenticationoption remains the knowledge based technique. Authenticationthrough this technique is improved by two approaches. In first,different graphical password schemes have been proposed,while in second approach schemes are suggested by enhancingor mixing text based and graphical password techniques.In this paper second approach has been taken for improving the security of traditional textual passwords. Proposedscheme provides enhancements in the login screen and theway passwords are stored into the database. In the loginscreen every time user inserts a new set of numbers whichwww.ijacsa.thesai.org513 P a g e

(IJACSA) International Journal of Advanced Computer Science and Applications,Vol. 8, No. 7, 2017represent the password, therefore proposed scheme providesresistance from spyware and man-in-the middle attacks. In theproposed password storage technique, alphanumeric charactersof a user’s password are transformed to different alphanumericcharacters and symbols and then stored into database. Thispassword transformation makes harder to apply dictionary andbrute force attacks.The remaining paper is divided into six sections. In section 2 literature review is given regarding the field of userauthentication. Proposed authentication scheme along withtechnique to store passwords are explained in section 3. Insection 4 analysis of the proposed scheme is given with respectto security, usability and memorability. Proposed scheme iscompared with famous authentication techniques in section 5.Finally conclusion is given in section 6.II.L ITERATURE R EVIEWUser authentication works on the basis of something userknows (Knowledge-based), something user has (token-based)or something user are (Biometric). Focus of this researchis to design an efficient user authentication scheme underthe category of knowledge-based authentication. Thereforeliterature review targets knowledge-based authentication. Thissection has been divided into two parts in first, differentuser authentication schemes are discussed which are relatedwith the research work. In the second part, problems in userauthentication schemes are briefly discussed.A. Related workZhao and Li [7] proposed some changes in textual password scheme for adding resistance to shoulder surfing attackand called the scheme as S3PAS. In this scheme registrationprocess is same as textual password scheme but the login process is different. In the login screen alphanumeric charactersare randomly shown in the image format and a user has to clickon the logical triangles formed by the password elements ortype characters which belong to each password triangle. S3PASscheme provides resistance from shoulder surfing, keystrokelogger and mouse logger attacks. Searching password trianglesis time consuming task, therefore this scheme is very difficultto use. The scheme is also vulnerable to dictionary and bruteforce attacks.Ziran et.al [8] proposed a text-based password scheme. Inthis scheme a user set password by drawing a shape inside aregistration screen. In the login screen a grid filed with 0sand 1s are randomly shown, a user is required to insert alist of 0s and 1s, such that they form the shape of password.Proposed scheme provides resistance from spyware attacks butthe scheme is vulnerable to brute force, dictionary and shouldersurfing attacks.Chen et al. [9] proposed a mixed textual and graphicalpassword scheme for resisting shoulder surfing attack. In thisscheme passwords consist of some characters and numbersalong with a colour. In the login screen characters and numbersare shown in circular format. Password is entered by rotatingpassword characters in front of the colour chosen during registration. Proposed scheme does not contain symbols therefore ithas small password space and password entry process requiresphysically efforts.Rao and Yalamanchili [10] proposed an authenticationscheme known as Pair Pass Char (PPC), in this scheme registration process is same as ordinary textual password scheme.In the login screen all alphanumeric characters are shown in10 * 10 grid. For password entry a user has to search logicalrectangles, formed by different pairs of password charactersand then click on the corner characters of the rectangles. Thescheme contain different rules for rectangle searching thereforethe scheme is difficult to learn. Average authentication time for6 characters password is 47.4 seconds which is quite high.First graphical password scheme was proposed by Blonder[5]. He proposed a scheme where a password consists ofcertain points inside a password picture. Blonder’s scheme hasmany security issues such as shoulder surfing attack and mouselogger attack. Wiedenbeck [11] proposed “PassPoint” schemebased upon Blonder’s scheme. In PassPoint scheme users havefreedom to click on any point inside the password picture,this freedom was not available in Blonders scheme. Passpointscheme is better than Blonders scheme with respect to bruteforce and dictionary attacks but it is not resilient to shouldersurfing and spyware attacks.Wiedenbeck et al. [12] proposed a shoulder surfing resilientgraphical password scheme known as CHC (Convex HullClick). In this scheme users are given multiple challenges forauthentication. In each challenge users have to find out threepassword images and then need to click inside an invisibletriangle formed by the password images. This scheme providesresistant from shoulder surfing attack but authentication timeis 71.66 seconds which is quite high.Lopez et al. [13] suggested a challenge response basedshoulder surfing and spyware attack resilient graphical password scheme. In this scheme three images per row are shownin the login screen. A user has to identify whether numberof password images are even or odd in different rows. Thescheme is weak with respect to brute force attack becausesmall number of images are used in this scheme. Combinedscreen scrapper and key logger attack become successful aftermultiple rounds of recordings.Weinshall [14] proposed a recognition based graphicalpassword scheme known as cognitive authentication scheme. Itprovides resistance form key logger and mouse logger spywareattacks. In the the scheme, 80 icons are presented into 8 *10 grid based login screen. Password icons are selected bycomputing a path generated by the icons. Learnability and highauthentication time are the issues with this scheme.Google introduced android unlock scheme, in which ninepoints are given into a 3 * 3 grid based login screen. Passwordof the scheme consists of some lines inside the grid. Thisscheme is very easy to use but the passwords can be capturedby shoulder surfing attack and the scheme also provides lowpassword space [6]. Microsoft introduced a graphical passwordscheme in windows 8, in which passwords consist of somepoints, lines or circles inside a picture. This scheme is alsovery easy to use but it has Hot-Spot and shoulder surfing issues[15].Akpulat et al. [16] proposed a hybrid graphical passwordscheme known as T&C. In hybrid schemes multiple userauthentication schemes are combined into single scheme. Inthis scheme passwords are consist of alphanumeric characterswww.ijacsa.thesai.org514 P a g e