Experimental studies of a graphical authentication system based on semantic categorisation

Salembier, Pascal; Zouinar, Moustafa; Heron, Robin; Mathias, Christophe; Lorant, Guirec; Wary, Jean-Philippe

doi:10.1145/3004107.3004121

Cited by 2 publications

(5 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In (Zouinar et al, 2016;Salembier et al, 2016), the authors use only 4 concepts by pictures, so the security is broken for 2 observations. Indeed, in practice even if many concepts are used to generate the different pictures, this solution is not secure after 2 or 3 observations by the attacker.…”

Section: Resultsmentioning

confidence: 99%

“…In (Salembier et al, 2016), the authors present the HSA protocol. They claim to be a mix between recall and cued-recall based schemes.…”

Section: Definitionmentioning

confidence: 99%

“…This implies that the user must decode how the concept has been represented into the image. The authors of (Salembier et al, 2016) claim that only a human can act as a good decoder. They give some examples.…”

Section: Definitionmentioning

confidence: 99%

“…A human limit is for example the number of pictures which are printed on the screen. In (Zouinar et al, 2016;Salembier et al, 2016), the authors use only 4 concepts by pictures. One has to remark than 4 is very small.…”

Section: Security/efficiency Trade-offmentioning

confidence: 99%

“…For example graphical passwords require the user to memorise a graphical sequence and not a number sequence. The HSA protocol introduced in (Zouinar et al, 2016;Salembier et al, 2016), appears as an efficient countermeasure against many attacks, particularly shoulder surfing attacks. The main idea of the HSA protocol is to have a concept password.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Theoretical Security Evaluation of the Human Semantic Authentication Protocol

Bouder

Thomas

Bourget

et al. 2018

Proceedings of the 15th International Joint Conference on E-Business and Telecommunications

View full text Add to dashboard Cite

Using a secret password or a PIN (Personal Identification Number) code is a common way to authenticate a user. Unfortunately this protection does not resist an attacker that can eavesdrop on the user (shoulder surfing attack). The Human Semantic Authentication (HSA) protocol proposes a solution against this attack. The main idea is to have concept passwords and to propose images that the user must correctly select in order to authenticate. A concept can be represented by different pictures, so one observation is not enough to retrieve the secret. In this paper, the security/efficiency trade-off in the HSA protocol is evaluated. A probabilistic approach is used. Under the assumption that the picture/concept database is known to the attacker, we show that HSA is barely more resistant to shoulder surfing attacks than a PIN code. More precisely we show that the probability to retrieve the secret concept password increases rapidly with the number of observations. Moreover the constraints on the size of the picture/concept database are very difficult to satisfy in practice.

show abstract

Section: Resultsmentioning

confidence: 99%

“…In (Salembier et al, 2016), the authors present the HSA protocol. They claim to be a mix between recall and cued-recall based schemes.…”

Section: Definitionmentioning

confidence: 99%

Section: Definitionmentioning

confidence: 99%

Section: Security/efficiency Trade-offmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%