Secure Recognition-Based Graphical Authentication Scheme Using Captcha and Visual Objects

Graphical password is an alternative scheme of alphanumeric password that is very tiresome process to recall the complex password. Psychological studies of human mind argue that recalling of image is easier than alphabets or digits. In this thesis, recognition based authentication built on Captcha technology is proposed. I propose method "Click-on-Captcha-Objects", which contains Captcha based visual objects (letters of any language, digits, and user-defined images); it helps memorability of a strong password. Proposed method was analyzed by two different approaches. One of them is usability and another one is security. For usability, 40 users participated in test to analyze how many users remember the complex password. Accuracy of the proposed scheme (percentage of users remembering the strong password) was 97.25%, in contrast to Captcha + text and Click-Text methods having accuracy of 88.75% and 93%, respectively. On the other hand, security analysis of the proposed system has been done with different types of attacks, popular four Captcha breakers software are used for Captcha images recognition. The proposed system resists in 98.5% cases against four Captcha breakers attacks. In contrary, Click-Text method resists in 95.5% cases. In addition, auto-mouse clicked attack analyzed; the performance against the attack of the proposed method was 97.66%, and Click-Text method performance was 95.41%. The results indicate that for proposed method it is easy to remember the strong password compared to alphanumeric and Click-Text based authentication schemes. Hence, performance of the proposed method is better than alphanumeric and Click-Text method. Traditional schemes of authentication mostly lead to guessable and unreliable password, but "Click-on-Captcha-Objects" provides reasonable security and usability to authenticate a legitimate user. In order to check the time of generation of each image at server, an experiment has been performed at SAMSUNG (Core i5, RAM 4 GB, Processor 2.53 GHz) laptop and the result was approximately 40 milliseconds per "Click-on-Captcha-Objects" image. Keywords: Graphical based authentication, secure password, Captcha based authentication, Click-on-Captcha-Objects