A Shoulder Surfing Attack Resistant by Graphical Based Authentication System

Abstract

— With the increasing amount of mobile devices and web services, users can access their personal accounts to
send confidential business emails, upload photos to albums in the cloud or remit money from their e-bank account
anytime and anywhere. While logging into these services in public, they may expose their passwords to unknown parties
unconsciously. People with malicious intent could watch the whole authentication procedure through omnipresent video
Cameras and surveillance equipment, or even a reflected image on a window. Once the attacker obtains the password,
they could access personal accounts and that would definitely pose a great threat to one’s assets. Shoulder surfing
attacks have gained more and more attention in the past decade. To resolve such issues, introduced a novel
authentication system PassMatrix, based on graphical passwords to resist shoulder surfing attacks. With a one-time
valid login indicator and circulative horizontal and vertical bars managing the overall scope of pass-images, PassMatrix
offers no hint for attackers to figure out or narrow down the password even they conduct multiple camera-based attacks.
We also implemented a PassMatrix prototype on web application and carried out real user experiments to evaluate its
memorability and usability. From the experimental result, the system achieves better resistance to shoulder surfing
attacks while achieving usability.