EAST WEST INSTITUTE OF TECHNOLOGY

DEPARTMENT OF INFORMATION SCIENCE

PROJECT SEMINAR
On
A SHOULDER SURFING RESISTANT
GRAPHICAL AUTHENTICATION
SYSTEM.

Prepared By: Guided By:

Hemanth Gowda K M (1EW15IS031) Mrs Mamatha B N
Lakshmi J (1EW15IS042) Asst professor
Navya P (1EW15IS062) Dept of ise, EWIT
Supritha S (1EW15IS111)
Introduction
■ Password authentication systems should encourage
less predictable and strong passwords while
maintaining memorability and security.
Alphanumerical usernames and passwords are most
commonly used for user authentication. One of the
drawbacks of choosing such schema is passwords
could be simply guessed.
Applications
■ Proposed system is invulnerable to the all types Shoulder
Surfing Attacks.

■ It overcomes the security weakness of the traditional PIN

method

■ It overcomes the easiness of obtaining passwords by observers

in public

■ It is 100% non Hackable.

Literature Survey
A. Paivio, T. Rogers, and P. Smythe, “Why are pictures
easier to recall than words?” Psychonomic Science,
1968.

■ Advantage:
Images are easy to remember as compared to the textual
password.
■ Disadvantage:
It failure to find a positive effect of color does not
support a simple interpretation of picture superiority in
terms of physical vividness or compounding of stimuli.
Graphical Password Authentication : Cloud Securing
Scheme, 2014
■ Advantage:
- Graphical password provides more security than
alphanumeric password.
- whenever we confirm the alphanumeric password there is
some hint option provided, using this hackers can easily gain
entry to the system in less time
■ Disadvantage:
- Drawback is that if one user has number of accounts, to
remember all those passwords, is simply not possible.
S3PAS:A Scalable Shoulder-Surfing Resistant
Textual-Graphical Password Authentication Scheme

■ Advantage:
This system being immune to shoulder-surfing, hidden-
camera, and spywar attacks.
■ Disadvantage:
It takes more time to authenticate the user, and more
computation will take place.
FakePointer: An Authentication Scheme for
Improving Security against Peeping Attacks Using
Video Cameras
■ Advantage:
This authentication scheme that ensures security even
if an attacker obtains a video record of an authentication
action
■ Disadvantage:
User has to struggle to authenticate.
Existing System
■ Users actions such as typing from their keyboard, or
clicking on the pass-images or pass-points in public
may reveal their passwords to people with bad
intention.
Disadvantages of Existing System
■ Existing System is vulnerable to shoulder
surfing attacks.

Type-I: Naked eyes.

Type-II:Video captures the entire

authentication process only once.
Proposed System
■ We introduced a graphical authentication system called
PassMatrix.In PassMatrix, a password consists of only one
pass-square per pass-image for a sequence of n images. The
number of images (i.e., n) is user-defined.

■ In PassMatrix, users choose one square per image for a

sequence of n images rather than n squares in one image as
that in the PassPoints scheme.
System Architechture
Modules
1. Admin:

Admin has to login to his account by the

authenticated user name and password.
Admin can able to view all the users details,
who are successfully registered.
■ User Registration
In this module user has to register by giving his
information such as userid, user name, password
,valid e-mail id etc, and after giving this
information, randomly three images will be
assigned to the user, in those images he has to
select the coordinate squares of the images as the
graphical password.
The details of coordinates of all images will be
stored in the database with respect to the specific
user.
■ User Login Process:
Registered user will be login to the application by
using his userid and password, if the userid and
password is valid One Time Password(OTP) will be
sent to the user’s e-mail, whereas OTP contains the
random pair of vertical and horizontal slider
coordinate points of all the three images. After
successful login , three assigned images will be
displayed to the user with horizontal and vertical
sliders , user has to set the horizontal and vertical
sliders for all the three images ,
■ Hash code generation:

After successful setting of the coordinates of the

images ,those details will be stored in the
database, concatenating all the three images
coordinates and generate hash code for that and
store in the database with respect to the user.
Results
■ Textual passwords can be guessed easily.
■ In the proposed system, images are used as password.
■ Image passwords are easy to remember as compared
to the textual password.
■ In the proposed model, User are authenticated by
Images and OTC.
■ It is difficult to guess, because each time OCT will
be changing.
Algorithms
■ Click Based Image Co-ordinate Generation
■ Password String creation & Secret Code generation
■ One Time Code (OTP) Generation
■ OTP Verification
■ Scroll Bar based Image Co-ordinate Generation
■ Secret code Comparison
■ MD5 (Message Digest 5) Algorithm.
Conclusion:
■ Conducting the authentication process in public might result
in potential shoulder surfing attacks.
■ Even a complicated password can be cracked easily through
shoulder surfing.
■ To overcome the shoulder surfing attack, we proposed a
shoulder surfing resistant authentication system based on
graphical passwords.
Reference:
[1]. S. Schneegass, Y. Oualil, and A. Bulling, “Skullconduct: Biometric user identification on eyewear computers
using bone conduction through the skull,” Proc. of CHI 2016, 2016

[2]. M. Harbach, A. De Luca, and S. Egelman, “The anatomy of smartphone unlocking,” in Proceedings of the
34th Annual ACM Conference on Human Factors in Computing Systems, CHI, 2016

[3]. V. M. Patel, N. K. Ratha, and R. Chellappa, “Cancelable biometrics: A review,” IEEE Signal Processing
Magazine, vol. 32, no. 5, pp. 54–65, 2015.

[4]. D. K. Yadav, B. Ionascu, S. V. K. Ongole, A. Roy, and N. Memon, “Design and analysis of shoulder surfing
resistant pin based authentication mechanisms on google glass,” in International Conference on Financial
Cryptography and Data Security. Springer Berlin Heidelberg, 2015, pp. 281–297.

[5]. N. Sae-Bae, N. Memon, K. Isbister, and K. Ahmed, “Multitouch gesturebased authentication,” IEEE
transactions on information forensics and security, vol. 9, no. 4, pp. 568–582, 2014.
 Any
Queries?
Thank You