Colloquium [RCA661]

A
Report
On
Novel 3D Graphical Password Schema
Submitted in partial fulfilment of the requirement for the
award of degree Of MCA

SUBMITTED TO: SUBMITTED BY:

Mr. Ashish Mishra Student Name : Anmol Dwivedi
(Assistant Professor,MCA) AKTU Roll No.-1743414905
 Preface

I have made this report file on the topic Novel 3D Graphical Password Schema; I

have tried my best to elucidate all the relevant detail to the topic to be included

in the report. While in the beginning I have tried to give a general view about this

topic. My efforts and wholehearted co-corporation of each and everyone has

ended on a successful note. I express my sincere gratitude to Mr. Ashish Mishra.

who assisting me throughout the preparation of this topic. I thank him for

providing me the reinforcement, confidence and most importantly the track for

the topic whenever I needed it.

Acknowledgement
 Abstract
In this paper, we propose and evaluate our contribution which is a new
scheme of authentication. This scheme is based on a virtual three-
dimensional environment. Users navigate through the virtual
environment and interact with items inside the virtual three dimensional
environment. The combination of all interactions, actions and inputs
towards the items and towards the virtual three dimensional environment
constructs the user’s 3D password. The 3D password combines most
existing authentication schemes such as textual passwords, graphical
passwords, and biometrics into one virtual three-dimensional
environment. The 3D password’s main application is the protection of
critical resources and systems.

Keywords
Three dimensional passwords, Textual passwords, Graphical passwords,
authentication, biometrics, Three Dimensional Virtual Environment.
 I. INTRODUCTION
Authentication is the process of validating who you are to whom you
claimed to be. In general, there are four human authentication
techniques:

 What you know (knowledge based).

 What you have (token based).
 What you are (biometrics).
 What you recognize (recognition based).
Textual passwords are the most common authentication techniques
used in the computer world. Textual password has two conflicting
requirements: passwords should be easy to remember and hard to guess.
Klein [1] acquired a database of nearly 15,000 user accounts that had
alphanumerical passwords, and stated that 25% of the passwords were
guessed using a small, yet wellformed dictionary of (3 × 106 ) words.
Even though the full textual password space for 8- character
passwords consisting of letters and numbers is almost (2 × 1014)
possible passwords, by using a small subset of the full space, 25% of the
passwords were guessed correctly. This fact is due to the user's
carelessness in selecting their textual passwords and to the fact that most
users do not select random passwords.
Many graphical passwords schemes have been proposed. The strength
of graphical passwords comes from the fact that users can recall and
recognize pictures more than words. Most graphical passwords are
vulnerable for shoulder surfing attacks, where an attacker can observe or
record the legitimate user’s graphical password by camera. A study [5]
concluded that the selection of faces in PassFaces[4] can be affected by
the attractiveness, gender and race of the selected face which results in
an insecure scheme. Currently, many types of graphical passwords are
under study yet, it might be some time before they can be applied in the
real world.
Token based systems such as ATMs are widely applied in banking
systems and in laboratories entrances as a mean of authentication.
However, tokens are vulnerable to loss or theft. Moreover, the user has
to carry the token whenever access required.
Many biometric schemes have been proposed. Each biometric
recognition scheme is different considering consistency, uniqueness, and
acceptability. Users tend to resist some biometrics recognition systems
due to its intrusiveness to their privacy.
The 3D password combines all existing authentication schemes into
one three-dimensional virtual environment. The three-dimensional
virtual environment consists of many items or objects. Each item has
different responses to actions. The user actions, interactions and inputs
towards the objects or towards the three-dimensional virtual
environment creates the user’s 3D password.
The 3D password gives users the freedom of selecting what type of
authentication techniques they want to be performed as their 3D
password. The 3D password has a large number of possible passwords
because of the high number of possible actions and interactions towards
every object and towards the three dimensional virtual environment.
The remainder of this paper is organized as follows: Section II
introduces the 3D password. Section III discusses the security analysis.
Section IV presents our conclusions and future work.
 II. 3D PASSWORD SCHEME
In this section we present a new scheme that addresses the shortcomings
of the existing authentication schemes.

 3D Password Overview
The three dimensional password (3D password) is a new authentication
methodology that combines recognition, recall, what you have (tokens),
and what you are (biometrics) in one authentication system. The idea is
simply outlined as follows. The user navigates through a three
dimensional virtual environment. The combination and the sequence of
the user’s actions and interactions towards the objects in the three
dimensional virtual environment constructs the user’s 3D password.
Therefore, the user can walk in the virtual environment and type
something on a computer that exist in (x1, y1, z1) position, then walk
into a room that has a white board that exist in a position (x2, y2, z2)
and draw something on the white board. The combination and the
sequence of the previous two actions towards the specific objects
construct the user’s 3D password. Users can navigate through a three
dimensional virtual environment that can contain any virtual object.
Virtual objects can be of any type. We will list some possible objects to
clarify the idea.
An object can be:

 A computer that the user can type in

 A white board that a user can draw on
 An ATM machine that requires a smart card and PIN
 A light that can be switched on/off
 Any biometric device
 Any Graphical password scheme
  Any real life object
 Any upcoming authentication scheme
Moreover, in the virtual three-dimensional environment we can have
two different computers in two different locations. Actions and
interactions with the first computer is totally different than actions
towards the second computer since each computer has a (x,y,z) position
in the three-dimensional virtual environment.
Each object in the virtual three-dimensional environment has its own
(x,y,z) coordinates, speed, weight and responses toward actions.

 3D Password Selection and Inputs

Consider a three dimensional virtual environment space that is of the
size G×G×G. Each point in the three dimensional environment space
represented by the coordinates (x, y, z) • [1..G] × [1..G] ×[1..G]. The
objects are distributed in the three-dimensional virtual environment.
Every object has its own (x,y,z) coordinates. Assume the user can
navigate and walk through the three-dimensional virtual environment
and can see the objects and interact with the objects. The input device
for interactions with objects can be a mouse, a keyboard, styles, a card
reader, a microphone …etc
User actions, interactions and inputs towards the objects and
towards the three-dimensional virtual environment are mapped into a
sequence of three-dimensional coordinates and actions, interactions and
inputs. For example, consider a user navigates through the three-
dimensional virtual environment and types "AB" into a computer that
exists in the position of (13, 2, 30). The user then walks over and turns
off the light located in (20, 6,12), and then goes to a white board located
in (55,3,30) and draws just one dot in the (x,y) coordinate of the white
board at the specific point of (530,250). The user then presses the login
button. The representation of user actions, interactions and inputs
towards the objects and the three-dimensional virtual environments can
be represented as the following:
(13,2,30) Action = Typing, "A", (13,2,30)
Action = Typing , "B", (20,6,12)
Action = Turning the Light, Off, (55,3,30)
Action = drawing , point = (530,250)
Two 3D passwords are equal to each other when the sequence of
actions towards every specific object are equal and the actions
themselves are equal towards the objects.
As described earlier, three-dimensional virtual environments can
be designed to include any virtual objects. The first step in building a 3D
password system is designing the three-dimensional virtual environment.
The selection of what objects to use, locations, and types of responses
are very critical tasks. The design affects the strength, usability and
performance of the 3D password. Figure 1 shows an experimental three-
dimensional environment.
 Figure (1): Snapshot of proof of concept three-dimensional virtual
environment. A virtual art gallery that consist of 36 pictures and 6
computers where users can navigate and interact with virtual objects by
either typing or drawing.

III. SECURITY ANALYSIS

The information content of a password space defined in [9] as "the
entropy of the probability distribution over that space given by the
relative frequencies of the passwords that users actually choose". It is a
measure that determines how hard the attack is. However, trying to have
a scheme that has very large possible passwords is one of the important
parts in resisting the attack on such a scheme.
We will analyze 3D passwords by discovering how large the 3D
password space is. Then we will analyze the knowledge distribution of
the 3D password.

 The Size of the 3D Password Space

First of all, by computing the size of the 3D Password space we
count all possible 3D Passwords that have a certain number of (actions,
interaction, and inputs) towards all objects that exist in the three-
dimensional virtual environment. We assume that the probability of a 3D
Password of a size greater than Lmax is zero.
 We will compute π (Lmax ,G ) on a three-dimensional space (G ×
G × G) for a 3D Password of a length (number of actions interactions
and inputs) of Lmax or less.
AC represents possible actions towards the objects. The symbol π
is defined as the total number of possible 3D Passwords that have a total
number of actions, interactions, and inputs equal to Lmax or less which
is equal to:

π (Lmax,G) = Σ(M+G(AC)) n (1)

Omax represent the total number of existing objects in the three-

dimensional virtual environment. The number Omax can be determined
based on the design of the three-dimensional virtual environment. The
variable m represents all possible actions and interactions towards all
existing objects Oi.
m = Σh(Oi,Ti,xi,yi,xi)
where xi=xj , yi=yj, and zi=zj only if i=j (2)
Where any new action, interaction, or inputs towards the objects or the
three-dimensional virtual environment of length n can be accumulated.
g(AC) is the total number of actions, inputs towards the three-
dimensional virtual environment excluding the actions towards the
objects which are already counted by m . An example of g(AC) can be a
user voice that can be considered as a part of user's 3D Password.
The function (Oi,Ti,xi,yi,xi) determines the number of possible actions
and interactions towards the object Oi based on the object type (Ti ).
Possible object types are textual password objects, graphical password
objects, DAS [9] graphical passwords objects, fingerprint objects, etc.
 h (Oi,Ti,xi,yi,xi) = (Oi,Ti,xi,yi,xi) (3)
Each object of a certain type (T) has its own formula f that
determines the possible actions and interactions the object can accept. If
we assume that an object "Keyboard" in location x=S0, y= S1, z= S2 of
type = textual password, then the possible actions will be the size of
possible letters and numbers that can be typed using the "Keyboard",
which is almost 93 possibilities. T can also be a type of object that
accepts DAS [9] (so the user can draw something). Depending on the
argument of this object type, the actions and interactions towards the
objects can be determined. The more possibilities the function f has, the
larger the 3D Password space can be.
We noticed that by increasing the number of objects in the three-
dimensional virtual environment, the 3D password space increases
exponentially. The design of the three dimensional virtual environments
is the key for the 3D password space. Figure (2) illustrate the key size
space of a possible 3D password as specified in section (IV.A) in
comparison with PassFaces, DAS of grid 5×5, DAS of grid 10×10 and
textual password. We noticed the huge difference between the 3D
password space and other authentication schemes.

 3D Password Distribution Knowledge

Having knowledge about the most probable textual passwords is the
key behind dictionary attacks. Any authentication scheme is affected by
the knowledge distribution of the user’s secrets

Knowledge about the user’s selection of three-dimensional

passwords is not available, up to now, to the attacker. Moreover, having
different kinds of authentication schemes in one virtual environment
causes the task to be more difficult for the attacker. However, in order to
acquire such knowledge, the attacker must have knowledge about every
single authentication scheme and what are the most probable passwords
using this specific authentication scheme. This knowledge, for example,
should cover the user’s most probable selection of textual passwords,
different kinds of graphical passwords, and knowledge about the user’s
biometrical data. Moreover, knowledge about the design of a three-
dimensional virtual environment is required in order for the attacker to
launch a customized attack.
IV. EXPERIMENTAL RESULTS
As a proof of concept we have built an experimental three dimensional
virtual environment that consist of many objects. Objects initially have
two kinds of responses to reactions, they are, objects that accept textual
passwords and objects that accept graphical passwords. Almost 30 users
have tested the experimental environment.

 Experimental Virtual Three-Dimensional Environment

We have built a small experimental three-dimensional virtual
environment. The three-dimensional virtual environment is simply an art
gallery that the user can walk into. It consists of the following virtual
objects:

 6 computers that accept textual passwords

 36 pictures that the users can click on, anywhere in the picture,
as a part of their 3D password
The pictures and the computers are scattered in the threedimensional
virtual environment.
 Figure (2): A comparison between the full password space of 3D
Password, Textual Password, PassFaces of size (3×3 possible faces each
turn), DAS of grid size (5× 5), and DAS of grid size (10 × 10). The
length represents the number of characters for the textual passwords, the
number of actions, interactions and inputs towards the objects for the 3D
password, the number of selections for Passfaces, and the number of
points that represent the strokes for DAS. The length is up to 32
(characters/actions, interactions, and inputs/selections). The 3D
password virtual environment is as specified in Section (IV.A). We can
see how the 3D password’s possible passwords are much larger than
most existing authentication schemes.
 V. CONCLUSION AND FUTURE WORK
Textual passwords and token-based passwords are the most
common used authentication schemes. However, many different
schemes have been used in specific fields. Other schemes are under
study yet they have never been applied in the real world.
The motivation of this work is to have a scheme that has a huge
password space while also being a combination of any existing, or
upcoming, authentication schemes into one scheme.
A 3D password gives the user the choice of modeling his 3D
password to contain any authentication scheme that the user prefers.
Users do not have to provide their fingerprints if they do not wish to.
Users do not have to carry cards if they do not want to. Users have the
choice to model their 3D password according to their needs and their
preferences.
A 3D password’s probable password space can be reflected by the
design of the three-dimensional virtual environment, which is designed
by the system administrator. The three-dimensional virtual environment
can contain any objects that the administrator feels that the users are
familiar with. For example, football players can use a threedimensional
virtual environment of a stadium where they can navigate and interact
with objects that they are familiar with.
The 3D password is in its infancy. A study on a large number of
people is required. We are looking at designing different three-
dimensional virtual environments that contain objects of all possible
authentication schemes.
The main application domains of 3D Password are critical systems
and resources. Critical systems such as military facilities, critical servers
and highly classified areas can be protected by 3D Password system with
large threedimensional virtual environment. Moreover, a small
threedimensional virtual environment can be used to protect less critical
systems such as handhelds, ATM's and operating system's logins.
Acquiring the knowledge of the probable distribution of a user’s
3D password might show the practical strength of a 3D password.
Moreover, finding a solution for shoulder surfing attacks on 3D
passwords and other authentication schemes is also a field of study.
 REFERENCES
[1] Daniel V.Klein. Foiling the Cracker: A Survey of, and Improvement
to Passwords Security. Proceedings of the USENIX Security Workshop,
1990.
[2] Greg E. Blonder, Graphical Password, United State Patent 5559961,
September 1996.
[3] Rachna Dhamija, Adrian Perrig, Déjà Vu: A User Study Using
Images for Authentication. In the 9th USINEX Security Symposium,
August 2000, Denver, Colorado, pages 45-58.
[4] Real User Corporation. The Science Behind Passfaces.
http://www.realusers.com accessed October 2005.
[5] Darren Davis, Fabian Monrose, and Michael K. Reiter. On user
choice in Graphical Password Schemes. In Proceedings of the 13th
USENIX Security Symposium, San Diego, August, 2004.
[6] Susan Wiedenbeck, Jim Waters, Jean-Camille Birget, Alex Brodskiy,
Nasir Memon. Authentication using graphical passwords: effects of
tolerance and image choice. In the Proceedings of the 2005 symposium
on Usable privacy and security, Pittsburgh, Pennsylvania, July
2005,pages: 1 – 12
[7] Susan Wiedenbeck, Jim Waters, Jean-Camille Birget, Alex
Brodskiy, Nasir Memon. Authentication Using Graphical Passwords:
Basic Results. In the Proceedings of Human-Computer Interaction
International, Las Vegas, July 25-27, 2005.
[8] Susan Wiedenbeck, Jim Waters, Jean-Camille Birget, Alex
Brodskiy, Nasir. Memon. PassPoints: Design and longitudinal
evaluation of a graphical password system', International Journal of
Human-Computer Studies (Special Issue on HCI Research in Privacy
and Security), 63 (2005) 102-127.
[9] Ian Jermyn, Alain Mayer, Fabian Monrose, Michael K. Reiter, and
Aviel D. Rubin. The Design and Analysis of Graphical Passwords, In
Proceedings of the 8th USENIX Security Symposium, August,
Washington DC, 1999.
[10] J. Thorpe, P.C. van Oorschot. Graphical Dictionaries and the
Memorable Space of Graphical Passwords. USENIX Security 2004, San
Diego, August 9-13, 2004.
[11] Adams, A. and Sasse, M. A. (1999). Users are not the enemy: Why
users compromise computer security mechanisms and how to take
remedial measures. Communications of the ACM, 42(12):40-46.