Collaborative Research: Graphical Passwords -- Design, Analysis, and Human Factors

建议编号：CCR-0310793，CCR-0310490，CCR-0310159和CCR-0310571TITLE：图形密码--设计、分析和人为因素PI：J.C.Birget和Dawei Hong(罗格斯-卡姆登)，Co-PI：S.Man(美国西南州立大学，明尼苏达州)，N.Memon(理工大学，布鲁克林)，S.Wiedenbeck(Drexel)。摘要：如果密码复杂到足以安全，人类就不擅长记忆字母数字密码。图形密码似乎更容易记住和使用。这里，显示图像，并且用户选择图像中的几个位置。要登录，用户必须再次单击靠近这些位置。较旧的系统使用具有预定义点击区域的预处理图像，用户必须在其中进行选择。调查人员设计的系统允许用户选择任何点作为点击点，并允许用户导入自己的图像。研究人员发明了一种“稳健离散化”的图像；这使用户能够产生完全相同的离散密码，即使他们不能在每次登录时点击完全相同的像素。密码容易受到“肩部冲浪”的攻击，“肩部冲浪”是指用户在登录期间被人观察或拍摄。研究人员设计了不受肩部冲浪影响的密码系统。该方案的目标之一是一项人为因素研究，涉及图形密码系统的可学性、记忆性、速度、安全性(不安全做法)和用户满意度。第二个目标是基于曲线、运动和三维场景设计新的图形化密码系统，以及设计用户可以在不同帐户上使用且易于作为一个组记住(和区分)的密码的“捆绑”。新的稳健离散化算法和对图形密码系统安全性的概率分析将被开发出来。

1) Abstract===========Proposal Number:CCR-0310793, CCR-0310490, CCR-0310159 and CCR-0310571TITLE:Graphical Passwords -- Design, Analysis, and Human FactorsPI: J.C. Birget and Dawei Hong (Rutgers-Camden),Co-PIs:S. Man (Southwest State U., Minnesota),N. Memon (Polytechnic U., Brooklyn),S. Wiedenbeck (Drexel).Abstract:Humans are not good at remembering alpha-numeric passwords, if the passwords are complicated enough to be secure. Graphical passwords seem easier to remember and to use. Here, an image is displayed and the user chooses a few places in the image. To log in, the user has to click close to these places again. Older systems use preprocessed images with predefined click regions, among which a user has to choose. The investigators designed systems that allow users to choose any points as click points, and that allow users to import their own images. The investigators invented a ``robust discretization'' of images; this enables users to produce exactly the same discrete password even though they cannot click on exactly the same pixels at each login. Passwords are vulnerable to ``shoulder surfing'', which consists of a user being observed, or filmed, during login. The investigators designed password systems that are immune to shoulder surfing.One of the objectives of this proposal is a human factors study, concerning learnability, memorability, speed, security (unsafe practices), and user satisfaction of graphical password systems. A second objective is to design new graphical password systems, based on curves, movement, and three-dimensional scenes, as well as to design ``bundles'' of passwords that a user can use on different accounts, and that are easy to remember (and distinguish) as a group. New robust discretization algorithms and probabilistic analyses of the security of graphical password systems will be developed.