1

Abstract
The most common computer authentication method is to use
alphanumerical usernames and passwords. This method has been shown to have
significant drawbacks. For example, users tend to pick passwords that can be
easily guessed. On the other hand, if a password is hard to guess, then it is often
hard to remember.
To address this problem, some researchers have developed
authentication methods that use pictures as passwords. In this paper, we conduct
a comprehensive survey of the existing graphical password techniques. We
classify these techniques into two categories: recognition-based and recall-based
approaches. We discuss the strengths and limitations of each method
and point out the future research directions in this area.
We also try to answer two important questions: Are graphical
passwords as secure as text-based passwords?; What are the major design and
implementation issues for graphical passwords. In this paper , we are conducting
a comprehensive survey of existing graphical image password authentication
techniques.Also we are here proposing a new technique for graphical
authentication.

2
Pictures are generally easier to be
remembered or recognized than text. In
addition, if the number of possible

Introduction:

pictures is sufficiently large, the possible

Human factors are often considered the

password space of a graphical

weakest link in a computer security

password scheme may exceed that of

system. pointout that there are three

text-based schemes and thus presumably

major areas where human-computer

offer better resistance to dictionary

interaction is important: authentication,

attacks. Because of these advantages,

security

there is a growing interest in

operations,

and

developing

secure systems. Here we focus on the

graphical password. In addition to

authentication problem.On the other

workstation and web log-in applications,

hand, passwords that are hard to guess or

graphical passwords have also been

break are often hard to remember.

applied to ATM machines and mobile

Studies showed that since user can only

devices.

remember

In

limited

number

of

this

paper,

we

conduct

passwords, they tend to write them down

comprehensive survey ofthe existing

or will use the same passwords for

graphical password techniques. We will

different

the

discuss the strengths and limitations of

problems with traditional username-

each method and also point out future

password

alternative

research directions in this area. In this

such

paper, we want to answer the following

accounts.

To address

authentication,

authentication

methods,

as

biometrics, have been used. In this

paper, however, we will focus on another

questions:
Are graphical passwords as secure

alternative: using pictures as passwords.

as text passwords?

Graphical password schemes have been

What are the major design and

implementation issues for graphical
passwords?

proposed as a possible alternative to

text-based schemes, motivated partially
by the fact that humans can remember
pictures better than text; psychological
studies

supports

such

assumption.

Overview of the Authentication

Methods:
Current authentication methods can be
divided into

3
Three main areas:
Token based
authentication
Biometric based
authentication
Knowledge based
authentication

based and recall-based graphical

techniques. Using recognition-based
techniques, a user is presented with a set
of images and the user passes the
authentication by recognizing and
identifying the images he or she selected
during the registration stage. Using

Token based techniques, such as key

recall-based techniques, a user is asked

cards, bank cards and smart cards are

to reproduce something that he or she

widely used. Many token-based

created or selected earlier during the

authentication systems also use

registration stage.

knowledge based techniques to enhance

Recognition Based Techniques

security. For example, ATM cards are

generally used together with a PIN
number.
Biometric based authentication
techniques, such as fingerprints, iris
scan, or facial recognition, are not yet
widely adopted. The major drawback of
this approach is that such systems can be
expensive, and the identification process
can be slow and often unreliable.
However, this type of technique provides
he highest level of security.
Knowledge based techniques are
the most widely used authentication
techniques and include both text-based
and picture-based passwords. The
picture-based techniques can be further
divided into two categories: recognition-

Dhamija and Perrig proposed a

graphical authentication scheme based
on the HashVisualization technique . In
their system, the user is asked to select a
certain number of images from a set of
random pictures generated by a
program . Later, the user will be required
to identify the pre selected images in
order to be authenticated. The results
showed that 90% of all participants
succeeded in the authentication using
this technique, while only 70%
succeeded using text-based passwords
and PINS. The average log-in time,
however, is longer than the traditional
approach. A weakness of this system is
that the server needs to store the seeds of
the portfolio images of each user in plain

4
text. Also, the process of selecting a set

user moves a frame (and the objects

of pictures from the picture database can

within it) until the pass object on the

be tedious and time consuming for the

frame lines up with the other two pass-

user.

objects. The authors also suggest

repeating the process a few more times
to minimize the likelihood of logging in
by randomly clicking or rotating. The
main drawback of these algorithms is
that the log in process can be slow.

Random images used by Dhamija and

Perrig

Sobrado and Birget developed a

graphical password technique that deals
with the shoulder-surfing problem. In the
first scheme, the system will display a

A shoulder-surfing resistant
graphical password scheme

number of pass-objects (pre-selected by

user) among many other objects. To be

Man, et al. proposed another shoulder-

authenticated, a user needs to recognize

surfing resistant algorithm. In this

pass-objects and click inside the convex

algorithm, a user selects a number of

hull formed by all the pass-objects.In

pictures as pass-objects. Each pass-

order to make the password hard to

object has several variants and each

guess, Sobrado and Birget suggested

variant is assigned a unique code.

using 1000 objects, which makes the

During authentication, the user is

display very crowded and the objects

challenged with several scenes. Each

almost indistinguishable, but using fewer

scene contains several pass-objects (each

objects may lead to a smaller password

in the form of a randomly chosen

space, since the resulting convex hull

variant) and many decoy-objects. The

can be large. In their second algorithm, a

user has to type in a string with the

5
unique codes corresponding to the pass-

enrollment stage, a user selects a theme

object variants present in the scene as

(e.g. sea, cat, etc.) which consists of

well as a code indicating the relative

thumbnail p

location of the pass-objects in reference

to a pair of eyes. The argument is that it

is very hard to crack this kind of

password even if the whole
authentication process is recorded on
video because where is no mouse click
to give away
the pass-object information. However,

photos and then registers a

this method still requires users to

sequence of images as a password

memorize the alphanumeric code for

.During the authentication, the user

each pass-object variant. Hong, et al.

must enter the registered images in the

later extended this approach to allow the

correct sequence. One drawback of

user to assign their own codes to pass-

this technique is that since the number

object variants. However, this method

of thumb nail images is limited to 30,

still forces the user to memorize many

the password space is small. Each

text strings and therefore suffer from the

thumbnail image is assigned a

many drawbacks of text-based

numerical value, and the sequence of

passwords.

selection will generate a numerical

password. The result showed that the
image sequence length was generally
shorter than the textural password
length. To address this problem, two
pictures can be combined to compose a
new alphabet element, thus expanding

An example of Passfaces

the image alphabet size.

Jansen et al proposed a graphical

password mechanism for mobile
device .during the

RECALL BASED
Reproduce a drawing:

Draw-a-Secret (DAS) technique proposed

by Jermyn, et al

Nali and Thorpe conducted further

A graphical password scheme
proposed by Jansen, et al

analysis of the Draw-A-Secret (DAS)

scheme. In their study, users were asked

Jermyn, et al. proposed a technique,

to draw a DAS password on paper in

called Draw - a - secret (DAS), which

order to determine if there are

allows the

predictable characteristics in the

user to draw their unique password .A

graphical passwords that people choose.

user is asked to draw a simple picture on

The study did not find any predictability

a 2D

in the start and end points for DAS

grid. The coordinates of the grids

password strokes, but found that certain

occupied by the picture are stored in the

symmetries (e.g. crosses and rectangles),

order of the drawing. During

letters, and numbers were common. The

authentication, the user is asked to re-

PassPoint system by Wiedenbeck, et

draw the picture. If the drawing touches

al. extended Blonders idea by

the same grids in the same sequence,

eliminating the predefined boundaries

then the user is authenticated. Jermyn, et

and allowing arbitrary images to be

al.

used. As a result, a user can click on any

suggested that given reasonable-length

place on an image (as opposed to some

passwords in a 5 X 5 grid, the full

pre-defined areas) to create a password.

password space of DAS is larger than

A tolerance around each chosen pixel is

that of the full text password space.

calculated. In order to be authenticated,

the user must click within the tolerance
of their chosen pixels and also in the

7
correct sequence . This technique is

pictures which act as passwords,these

based on the discretization method

are given by server. Since any image is

proposed by Birget, et al. . Because any

made of pixels we have its gray level

picture can be used and because a

concentration. In this way the image will

picture may contain hundreds to

be distorted and cant be in original

thousands of memorable points, the

possible password space is

form.so it is not easy for hacker to

reproduce the original form of image.
The flow chart of the proposed technique

quite large.

is given below.
Step 1:User
will select an
image from
data base as
password

An image used in the Passpoint Sytem,

Step 2:Image
clustering
will takes
place

Step 8 User will

allow sufing on
website

If
passwor
d
mathces

Wiedenbeck, et al

New Technique For Graphical

Password Authentication
. Here we are poposing a new algorithm
of

authentication

using

graphical

Step
3:Distributes the
clusters
throughout
image space

Step 7: image gets

compared to
original

images.when a ;user tries to register over

a network we will ask him or her to selet
a theme or sequence of pictures from
already given image frame.The local

Step 4:password
stores as encrypted
password

host downloads an image frame which

contains various themes of sequence of

Step 5:For login user

wll again asked to
pick up an image
from database

Step 6 Server
reproduce
encrypted image
using neural
networks

Other
wise go
to step
5

Block diagram for the New

Technique

The

Is a graphical password as
secure as text-based password?

motion to imitate human input, which is

Very little research has been done to

graphical passwords. Overall, we believe

study the difficulty of cracking graphical

a graphical password is less vulnerable

passwords. Because graphical passwords

to brute force attacks than a text-based

are not widely used in practice, there is

password.

no report on real cases of breaking

attack

programs

need

to

automatically generate accurate mouse

particularly difficult for recall based

Dictionary attacks

graphical passwords. Here we briefly

Since recognition based graphical

exam some of the possible techniques

passwords involve mouse input instead

for breaking graphical passwords and try

of keyboard input, it will be impractical

to do a comparison with text-based

to carry out dictionary attacks against

passwords.

this type of graphical passwords. For

Brute force search

some recall basedgraphical passwords it

The main defense against brute force

is possible to use a

search is to have a sufficiently large

dictionary attack but an automated

password space. Text-based passwords

dictionary attack will be much more

have a password space of 94^N, where

complex than a text based dictionary

N is the length of the password, 94 is the

attack. More research is needed in this

number of Printable characters excluding

area. Overall, we believe graphical

SPACE.

passwords are less vulnerable to

Some

graphical

password

techniques have been shown to provide a

dictionary attacks than text-based

password space similar to or larger than

passwords.

that

of

text-based

passwords.

Recognition based graphical passwords

tend to have smaller password spaces
than the recall based methods.
It is more difficult to carry out a brute
force attack against

graphical

passwords than text-based passwords.

Guessing

Unfortunately, it seems that graphical

passwords are often predictable, a
serious problem typically associated
with text-based passwords. For example,
studies on the Passface technique have
shown that people often choose weak

and predictable graphical passwords.

involving only a small number of users.

Nali and Thorpes study revealed

We still do not have convincing evidence

similar predictability among the

demonstrating that graphical passwords

graphical passwords created with the

are easier to remember than text based

DAS technique . More research efforts

passwords.

are needed to understand the nature of

graphical passwords created by real

A major complaint among the users of

world users.

graphical passwords is that the password

Shoulder surfing

Like text based passwords, most of

registration and log-in process take too

long, especially in recognition-based

the graphical passwords are vulnerable

approaches. For example, during the

to shoulder surfing. At this point, only a

registration stage,a user has to pick

few recognition-based techniques are

images from a large set of selections.

designed to resist shoulder-surfing .

During authentication stage, a user has

None of the recall-based based

to scan many images to identify a few

techniques are considered

pass-images.

should-surfing resistant.

Users may find this process long and

tedious. Because of this and also because

What are the major design and

implementation issues of
graphical passwords?
Security
In the above section, we have briefly
examined thesecurity issues with
graphical passwords.

Usability

most users are not familiar with the

graphical passwords, they often find
graphical passwords less convenient than
text based passwords.

Reliability
The major design issue for recall-based
methods is the reliability and accuracy of

One of the main arguments for graphical

user input recognition. In this type of

passwords is that pictures are easier to

method, the error tolerances have to be

remember than text strings. Preliminary

set

user studies presented in some research

carefully overly high tolerances may

papers seem to support this. However,

lead to many false positives while overly

current user studies are still very limited,

low tolerances may lead to many false

negatives. In addition, the more error

tolerant the program, the more

to

vulnerable it is to attacks.

preliminary analysis suggests that it is

Storage and communication

more

Graphical passwords require much more

storage spacethan text based passwords.

support
difficult

this
to

argument.
break

Our

graphical

passwords using the traditional attack

methods such as brute force search,

Tens of thousands of pictures may have

dictionary attack,or spyware. However,

to be maintained in a centralized

since there is not yet wide deployment of

database. Network transfer delay is also

graphical

a concern for graphical passwords,

password

systems,

the

vulnerabilities of graphical passwords

especially for recognition-based

are still not fully understood.

techniques in which a large number of

Overall, the current graphical password

pictures may need to be displayed for

techniques are still immature. Much

each round of verification.

more research and user studies are

Conclusion:

needed

The past decade has seen a

for

graphical

password

techniques to achieve higher levels of

growing interest in using graphical

maturity and usefulness.

passwords as an alternative to the

References:

traditional text-based passwords. In this

paper,

we

have

comprehensive

conducted

survey

of

existing

graphical password techniques. The

current graphicalpassword techniques
can be classified into two categories:
recognition-based

and

recall-based

techniques..
Although

the

main

argument

for

graphical passwords is that people are

better

at

memorizing

graphical

passwords than text-based passwords,

the existing user studies are very limited
and there is not yet convincing evidence

[1] A. S. Patrick, A. C. Long, and S.

Flinn, "HCI and
Security Systems," presented at CHI,
Extended
Abstracts (Workshops). Ft. Lauderdale,
Florida, USA.,
2003.
[2] A. Adams and M. A. Sasse, "Users
are not the enemy:
why users compromise computer
security mechanisms
and how to take remedial measures,"
Communications
of the ACM, vol. 42, pp. 41-46, 1999.
[3] K. Gilhooly, "Biometrics: Getting
Back to Business," in
Computerworld, May 09, 2000.