Authentication based password is largely used in the computer security and privacy. Most of the traditional passwords are numbers and alphabets character. The unauthorized people can easily identify the password. The identification leads the shoulder surfing attacks. However, human actions such as choosing bad passwords and inputting passwords in an insecure way are regarded as “the weakest link” in the authentication chain. With web applications and mobile apps piling up, people can access these applications anytime and anywhere with various devices. To overcome these problems we introduce a novel authentication system called PassMatrix resist shoulder surfing attacks.
Secure Session Password authentication system is offered that protects users from becoming fatalities of shoulder surfing attacks when inputting passwords in public through the usage of 6×6 square matrix, which is filled with alphabets from a-z and numerical from 0-9. This square matrix is randomly generated on submit of each password character. The matrix provides better security against shoulder surfing attacks, since users use a dynamic pointer to point out the position of their passwords rather than clicking on the password object directly.

                                                            CHAPTER 1

 

INTRODUCTION

 

 

 

1.1 INTRODUCTION

 

This chapter presents the general idea of the research; including the scope of the thesis, research questions and aims and objectives to find answers to those questions. It also briefly explains the research approach and the research methods used in the several empirical studies which are conducted to evaluate the proposed idea in this thesis. At the end of this chapter, the thesis contributions are presented and the organisation of the thesis is detailed.

 

 

 

1.2 RESEARCH BACKGROUND AND SCOPE

 

As information technology is an inevitable necessity in today’s world, computer and information security has become critically important for many organisations. In computer systems, this issue has been mostly about ensuring confidentiality, integrity and accessibility to information. Because of the importance of the subject, numerous studies have been conducted in this area but unfortunately most of the researchers have primarily focussed on technical problems and solutions rather than human factors in information systems (Hoonakker, Bornoe and Carayon, 2009).

 

Human factors in security systems are often overlooked although this is one of the most important aspects of computer security. In recent years, researchers have started to pay attention to this subject and some studies have emerged to show the effect of the human role on computer and information security. Also, recently, the security research community has stated that users’ behaviour plays an important role in many security failures (Cranor, 2008). Undesirable user behaviour causes the majority of the security failures in the organisations. There are many reported cases proving that user behaviours enabled or facilitated a security breach (Sasse, Brostoff and Weirich, 2001). The main reason for this situation is that end users generally have difficulties to understand

2

 

 

computer security properly. Computer security terms such as encryption, public key,private key or phishing or pharming techniques used in sophisticated attacks usually do not make any sense to most end users. This is not only about the complexity of the terms but also the proffered solutions to security problems are changing rapidly. End users are unable to cope (Zakaria, 2013).

 

One of the important points about complexity is to consider that computer security is often investigated as a secondary task. Most users find the security mechanisms too burdensome so they prefer to avoid security efforts in order to perform their primary task. There is mostly a contradiction between the user’s idea of how the system works and how the system actually works which leads to making inappropriate security-related decisions. Users generally are not motivated to care about security because the effects or consequences of not behaving in a secure manner do not appear immediately. Therefore, they often only realize the situation after they have become the next victim of a security failure.

 

There are two main research areas in which user behaviour issues are being currently studied. The first one is information security management (ISM) which mainly focuses on some approaches such as education, training and security awareness programs (Woodhouse, 2007; Herath and Rao, 2009). Yet these approaches have not been a solution for motivating users to behave securely. The second area is usable security in which researchers have studied the inclusion of usability elements into security mechanisms to make users engage in the task more willingly (Schultz et.al, 2001; Zurko, 2005). Despite these efforts, there is still a gap in the Human Computer Interaction (HCI) field in terms of designing usable security mechanisms to improve users’ motivation to adopt desired security behaviours.

 

Whitten and Tygar (1999) stated that PGP 5.0, one of the most popular encryption software used in the past, is not usable by average computer users because it has user interface design flaws. Since then, security researchers began to realize the importance of investigating human factors on security systems, and designing usable systems accordingly (Smith, 2003; Schenier, 2004).

3

 

 

User authentication is usually the first stage of a security sensitive system which users have to confront with to prove their right of access (Smith, 2001). There is an identification phase where the user claims that he/she is the person who has right to access the system and authorization phase where the user has to provide credentials to prove his/her claims (Renaud, 2005). The three differing authentications are what the user has, who the user is and what the user knows (Smith, 2001; Renaud, 2005). What the user has commonly imply the possession of a device such as digital authentication tokens or smart cards to prove the identity of users. These tokens are commonly used as security tools in enterprises. A research study about tokens and smart cards points out usability issues emerged from the need of installing drivers on a range of machines to support different forms of tokens and cards (Piazzalunga et.al, 2005). In terms of authentication, who theuser is refers to biometrics which measure user’s physiological or behavioural characteristics. Biometrics are considered the best solution since they give accurate results about the claimed identity thus provide high level security. However, in practice, they have many usability and security issues. Non-adaptation of some user groups to biometrics systems (Coventry, 2005), the possibility of imitation of some biometrics such as mocking finger prints using special materials and also affordability problems of these systems are some of aforementioned issues. What the user knows (often referred to as knowledge based authentication) typically requires the user remember a secret he/she created before and provide it when asked to gain access a system. Text-based password is the oldest and most commonly used type of knowledge based authentication. Text password is ubiquitous on the Internet since it is affordable, widely deployed, familiar to users and easy to replace.

 

Authentication, as one of the most important fields of computer security to allow authorized users to access information, has been studied by many usable security researchers. Various alternative authentication schemes to text-based passwords which aim at aligning security and usability, have been proposed so far. These proposals range from graphical password authentication to location-based authentication (Goldberg, Hagman and Sazaval, 2002; Forget, 2012; Thorpe, MacRae and Salehi-Abari, 2013). However, none of these schemes could overcome the simplicity and affordability of typing a sequence of keyboard characters to allow authenticating users (Bonneau, 2012). As a result, traditional text-based password is still the most popular authentication

4

 

 

mechanism on the Web, and it is likely to remain in the near future (Herley, Oorschot and Patrick, 2009).

 

Unfortunately, in terms of usability, text- based password authentication is quite problematic. A good password needs to be “easy to remember and hard to guess” at the same time, as suggested by Wiedenbeck et al. (2005a). However, passwords which are easy to remember are generally short and/or meaningful words, or slight variations. Therefore, these passwords become vulnerable to dictionary attacks. Passwords including personal information are also memorable, but they might be easily guessable especially by family members and friends.

 

A lot of work has been done to understand users’ password behaviour and practices. A landmark study involving half a million users was conducted by Microsoft Research and many interesting findings about users’ password habits were revealed (Florencio and Herley, 2007). Additionally, many researchers have focussed on password management, password guideline and advice issues and conducted laboratory studies, to understand the reasons behind particular password behaviours such as sharing or reusing passwords and to investigate possible security countermeasures (Gaw and Felten, 2006; Shay et al., 2010).

 

Considering the above-mentioned issues, this thesis aims to bridge the gap between password security and usability by focusing on human factor issues in the password authentication domain. As password security is one of the most important areas where human factors play a crucial role, it is important to investigate further the effect of user behaviour on password practices. Text passwords’ popularity, despite their weaknesses, makes the subject more interesting to study in terms of user behaviours. The next section presents the research problems pertaining to password security.

 

 

 

1.3 RESEARCH PROBLEMS

 

Password authentication is nowadays the most commonly used authentication mechanism and it seems likely that it will continue to be so for many years to come. This is because it is widely deployed, easy to use, affordable and familiar to users. Passwords

5

 

 

are used to protect users’ information in many platforms ranging from banking transactions to social networking sites. Thus, they play a key role in the protection of personal and financial information in online and offline environments.

 

Passwords are considered one of the most significant risk factors in terms of security in information systems as they are vulnerable to attacks (Carstens, Mc-Cauley and DeMara, 2004). This vulnerability is mainly due to the user behaviours and practices, not related to the password system itself. The main problem arises from the memorability issue which ultimately causes the other problems related to passwords such as reusing, sharing and choosing weak passwords. These problems are well-known and they are called as ‘the human factor problems’ by researchers in the password authentication domain (Herley, Oorschot and Patrick, 2009; Summers and Bosworth, 2004).

 

Most people are actually aware of the importance of choosing strong passwords to protect their information. However, there is a lack of password creation advice or guidelines to help and motivate them to compose strong passwords. It is commonly stated that a password should include a mix of keyboard characters and should not include the meaningful words from dictionaries (Yan et al., 2004). Similar advice can also be found in websites, policy papers and many other password security themed articles. Unfortunately, despite these guidelines and advice, most users do not adopt good security behaviours and care to choose strong passwords. Based on occurrences of security failures and the difficulty to determine which particular rules measure the importance or necessity of strong password creation, research shows that users commonly underestimate the risk associated with weak passwords. (Florencio and Herley, 2007; Zang and McDowell, 2009).

 

Shay et al. (2010) indicated that users often appear to lack motivation to produce strong passwords as they are not convinced of the importance of suggestions given in the guidelines. It was proved that users’ awareness of the problems is not enough to restrain them from adopting undesirable security practices such as using dictionary words, sharing and reusing their passwords. So, more effective approaches are needed to convince users to behave in a secure manner in the password authentication domain. Probably, rather than only telling them why they should choose strong passwords or restricting their choices with tedious password policy rules, showing how to create better passwords in efficient and fun ways is more convenient.

6

 

 

1.4 RESEARCH QUESTIONS AND OBJECTIVES

 

From the issues mentioned above it is clear that the existing password guidelines and advice have not solved the problem of weak password creation. New techniques are needed to help users to create strong passwords by presenting new solutions which will make the password creation process more reasonable, interesting and fun. The new solutions must motivate and lead users to construct strong passwords and also show the consequences of bad password practices. Thus, this research aims to find out whether a change in password guidelines and advice can bring a new perspective for users and to improve their password security behaviour. Furthermore, since user behaviour issues are extremely complex as they are shaped according to different environments and conditions users have. Based on this point, this research also aims to include an experiment for users working in organisations to improve understanding of their security behaviours particularly related to password practices. Some chosen elements of persuasiontechnologies have been used to change users’ undesirable password behaviours and convince them to adopt desired ones.

 

Although there should be efforts to persuade users to create strong passwords and abandon password sharing and reusing habits, the memorability problem will remain unchanged. To handle this problem, many studies have been conducted by researchers and various authentication mechanisms have been proposed in the industry. Among the mechanisms being proposed, a graphical password is the closest alternative to the traditional text-based password in terms of its implementation, affordability and easy usage. Various graphical password schemes recently emerged aiming to overcome the main weakness of traditional text-based (alphanumeric) passwords, which is memorability. They are indeed advantageous due to the fact that the human memory can recall graphical images better than text and numbers.

 

Despite their advantages, since graphical passwords are still not commonly used, further investigation is needed to find out whether they can completely replace the text-based passwords, or can only help to strengthen existing defences to attacks. Similar to other alternatives, graphical password schemes have many downsides particularly with regards to its weakness to spyware and shoulder surfing attacks. Thus, designing new graphical schemes to strengthen its defence to these attacks is crucial before it becomes

7

 

 

more established. At this point, hybrid authentication mechanisms are seen convenient to minimize the downsides of traditional text-based passwords and graphical passwords and use the advantages of both. We have investigated the potential of a hybrid password scheme as an alternative mechanism. Hence, this research has proposed a novel hybrid password authentication scheme which has upsides of text-based passwords and graphical passwords to offer a better solution than existing ones. This thesis presents solutions to these problems.

 

The research questions guiding this research study are as below:

 

 

1-  “How can password related behaviours, which may potentially lead to security failures, be changed to improve overall password security in organisations?”

 

2-  “To what extent can users be directed and motivated to choose strong passwords through password advice?”

 

3-  “Can graphical passwords entirely replace the textual passwords?”

 

 

4-  “Can a hybrid password authentication scheme integrating text and graphical passwords be solution to the password security and usability problems?”

 

The purpose of this research is to investigate user security behaviour in the password authentication domain and to offer usable solutions to decrease security risks caused by these behaviours. For this purpose, these research questions will be answered by achieving some objectives. The main objectives and concomitant research activities to be carried out for each question are listed below:

 

Main Objectives:

 

1-  Conducting a broad literature review to address the key issues of the research topic and to follow the related studies.

2-   Identifying the research problems, questions and gaps in the research field.

 

3-  Proposing solutions to the research questions specified.

 

4-   Evaluating the proposed solutions.

 

5-  Providing an overall discussion of the findings when conducting the research.

8

 

 

Research Activities Related to Each Research Question

 

 

1-   “How can password related behaviours, which may potentially lead to security failures, be changed to improve overall password security in organisations?”

 

Research Activities (1):

 

 

• Reviewing the studies and cases on employees’ security behaviour in password authentication in organisations.
• Examining the existing methods which aim to make employees adopt good security behaviours.

 

• Reviewing the related persuasion approaches and methods to change user behaviour.
• Applying the selected persuasion methods to change employees’ behaviour so they behave in a secure manner.

 

• Conducting empirical studies to analyse these methods’ efficiency.

 

• Drawing a conclusion from the results of the empirical studies.

 

 

 

 

2-   “To what extent can users be directed and motivated to choose strong passwords through password advice?”

 

Research Activities (2):

 

 

• Reviewing relevant studies on password policy rules and password advice.

 

• Examining the existing password policies and guidelines.

 

• Proposing a new idea which may solve the problems with the existing systems.

 

• Conducting an empirical study to find out whether the new idea works better to direct and motivate users to choose strong passwords than existing solutions.

 

• Drawing a conclusion from the results of the empirical study.

9

 

 

3-   “Can graphical passwords entirely replace the textual passwords?”

 

 

Research Activities (3):

 

 

• Reviewing the alternative authentication mechanisms to the traditional text password passwords and assessing the alternatives according to certain criteria.
• Examining the existing graphical password authentication schemes and deciding on the best alternative.

 

• Specifying the upsides and downsides of the decided scheme.

 

• Drawing a conclusion from the results of the research.

 

 

4-   “Can a hybrid password authentication scheme integrating text and graphical passwords be solution to the password security and usability problems?”

 

Research Activities (4):

 

 

• Based on the results of the research done for previous question, proposing a novel hybrid password authentication scheme including text and graphical passwords.

 

• Designing a web application to apply the proposed authentication scheme.

 

• Conducting an empirical study to test the proposed authentication scheme.

 

• Evaluating the efficiency of the new scheme to find out whether it is convenient to use for users to create memorable and strong passwords.
• Drawing a conclusion from the evaluation.

 

 

An empirical study called improving password security in organizations which is presented in chapter 4 addresses the first research question. The password guideline-advice study called persuading users to create stronger passwords which is presented in chapter 5 addresses the second research question. Chapter 6 which is a background chapter reviewing the existing authentication mechanisms and comparing the graphical password schemes aims to find solution to third research question. The last empirical study called evaluation of security and usability of a novel user authentication schemeintegrating text and graphical passwords which is presented in chapter 7 addresses the final research question. The details of the empirical studies and results are provided in the related chapters and overall discussion is presented in the last chapter.

10

 

 

1.5 RESEARCH APPROACH

 

This research study aims to investigate user security behaviour issues related to the password authentication domain and offer usable solutions to direct and motivate users to adopt desired behaviours. Thus, throughout this study, an empirical-based approach is adopted conducting three empirical studies to achieve the proposed research aim.

 

The first empirical study is conducting interviews and surveys with employees of big organisations to figure out the reasons behind bad password practices and find solutions to their lack of motivation to adopt good ones. A series of persuasion approach and methods have been reviewed and the selected ones have been used to convince and motivate users to avoid some security behaviours that put their personal information as well as the organisational information at risk. The study has been conducted in six organisations in Turkey including a hospital, a software company and a construction company. This involved 121 participants including IT managers, software specialists and other employees who do not have an IT background. The empirical study is detailed in Chapter 4.

 

The second empirical study is a “password guideline-advice study” that has been conducted to investigate whether providing users a series of useful password creation methods alongside a motivating rationale is more effective than strict policy rules in terms of creating strong and memorable passwords. The password advice and the password creation methods have been specified after a broad literature review was conducted. This empirical study involved 380 participants including university students from UK, USA and Turkey. Details of the password guideline- advice study are discussed in Chapter 5.

The third and final empirical study is evaluating a novel hybrid authentication scheme integrating text and graphical passwords. This novel authentication scheme has been designed after a broad literature review on alternative authentication mechanisms was conducted. This study involved 52 participants who are undergraduate and postgraduate students studying in the University of Sussex. Especially existing graphical password schemes were especially scrutinised, and eventually recall based graphical passwords were considered the best alternative to the traditional text-based passwords considering certain criteria. The results of this study showed how a hybrid password authentication scheme can improve password strength by taking advantages of the upsides of text and graphical passwords as well as eliminating the vulnerabilities of both. The details of the study, including the usability and security evaluation, are discussed further in Chapter 7 of this thesis.

 

1.6 CONTRIBUTIONS

 

This thesis aims to address security problems caused by human factors in textual and graphical password authentication, and to propose solutions for these problems while maintaining usability. This endeavour is detailed in the thesis through the following contributions to the field of user authentication and usable security:

 

• A user study has been conducted with participants in several organisations from different sectors to understand the reasons for undesired password behaviour in password authentication. It gives interesting results that led us proposing different security solutions for different organisations as needs and ways to motivate users in each organisation vary. Persuasion Technology has been used to convince users in the organisations to adopt good password behaviour. At the end of the study, some recommendations for IT departments which can be useful in improving password security and decreasing the probability of security failures significantly is presented.

 

• A new user-friendly password guideline and advice for motivating and influencing users to select more secure and memorable text passwords without overburdening their memory. A broad user study has been conducted to evaluate the efficiency of these password guideline and advice. It has yielded good results which suggests that the password creation tips and persuasive message provided to users convinced them to create cryptographically strong and memorable passwords. Also, the study suggests that this new password guideline and tips are much more efficient than strict password policy rules regarding creation of strong passwords.

 

• Design and evaluation of a novel hybrid authentication scheme integrating text and graphical passwords. The proposed scheme is resistant to shoulder surfing attack, which is the main security problem of graphical passwords. Also, the new scheme is enjoyable to use for users to motivate them to create strong but memorable passwords. Several user studies were performed to test the security and memorability of the passwords which users created with this scheme.

1.7 THESIS ORGANIZATION

The thesis has two main parts. The first part focuses on traditional text-based passwords: it investigates the usability and security problems caused by user behaviour in text-based password authentication domain. Some empirical studies are described, which aim at finding usable solutions to motivate users to create strong and memorable passwords as well as persuading them to avoid undesirable password practices in organisations. The second part of the thesis investigates alternative password mechanisms to text-based passwords and mainly focuses on graphical passwords. After a review of the existing graphical password mechanisms, it introduces a novel hybrid password authentication scheme including text and graphical passwords.

 

The thesis consists of eight chapters, broadly presenting background and related work, and analysing and discussing the findings of the empirical studies conducted to find usable solutions to password security problem.

 

Following this introduction chapter, Chapter 2 presents the background information and potential security issues of knowledge based authentication mechanisms focusing on text passwords. It describes the human factors that play an important role in the password authentication, and discusses the significance of balancing security and usability issues in password authentication systems. This chapter also lists possible security attacks and countermeasures in password authentication and presents a broad review of previous works related to password security.

 

Chapter 3 reviews the related behaviour change theories and persuasion strategies. Several selected appropriate persuasion approaches presented in this chapter will be utilised and evaluated in the following chapter.

13

 

 

 

 

Chapter 4 suggests the idea of utilising appropriate persuasion approaches to make users behave in a desired manner about password security. Although most organisations are aware of the importance of computer security, they have difficulties with teaching and influencing their users to behave securely. Existing studies on new instructions and security measures are still not enough to encourage users to avoid insecure password practices. Psychologists and other social scientists have suggested some methods and approaches for effective behavioural change which are discussed in the previous chapter in detail. This chapter includes some empirical studies which were conducted with employees of some big organisations using the aforementioned behavioural change methods and discusses whether using persuasive behavioural change methods can make users behave in a secure manner thus providing better password security in organisations.

 

Since the results of the empirical study presented in Chapter 4, and some previous research proved that the traditional methods of imposing excessive restrictions have not been very successful, it is suggested that a system that subtly persuades users and offers concrete advice may be more successful. Thus, based on the information gathered from previous studies and cases, Chapter 5 explores whether motivating users with an effective password advice and useful instructions to create strong and memorable passwords is better than obliging users to apply strict password policy rules. This chapter provides a broad understanding of human factors-caused security problems and offers a reliable solution by encouraging users to create their own formula to compose passwords.

 

Chapter 6 is a background chapter for the second part of this thesis, and presents a broad review of the existing authentication mechanisms. It emphasises the strong and weak sides of each mechanism, to find out whether a good alternative to traditional passwords exists considering certain criteria such as affordability, compatibility and ease of use. After analysing all the alternatives, it concludes that text-based passwords remain the most preferred mechanism followed by graphical passwords. Since text-based passwords are still the most prevalent method and graphical passwords are the most promising alternative, this chapter also discusses some solutions to improve security and usability of these passwords.

 

In Chapter 7, a new password authentication scheme based on text and image is introduced. It suggests using an integrated authentication mechanism, and questions whether the vulnerabilities of the text and graphical passwords are decreased thus resulting in an improved security level with this scheme. A web application has been designed to allow participants to test the hybrid scheme’s effectiveness.

Finally, Chapter 8 presents an overall discussion and conclusions drawn from the thesis. It describes the further studies which could be done to extend the research

Improved Session Password Based Security System