VIP: a visual approach to user authentication

ABSTRACT

This paper addresses knowledge-based authentication systems in self-service technology, presenting the design and evaluation of the Visual Identification Protocol (VIP). The basic idea behind it is to use pictures instead of numbers as a means for user authentication. Three different authentication systems based on images and visual memory were designed and compared with the traditional Personal Identification Number (PIN) approach in a longitudinal study involving 61 users. The experiment addressed performance criteria and subjective evaluation. The study and associated design exploration revealed important knowledge about users, their attitudes towards and behaviour with novel authentication approaches using images. VIP was found to provide a promising and easy-to-use alternative to the PIN. The visual code is easier to remember, preferred by users and potentially more secure than the numeric code. Results also provided guidelines to help designers make the best use of the natural power of visual memory in security solutions.

References

1. Adams, D. A. and Chang, S. Y. An investigation of keypad interface security. Information&Management 24 (1993), 53--59.
2. Adams, A. and Sasse, M. A. Users are not the enemy. Commun. ACM 42 (December 1999), 41--46.
3. Ashbourn, J. Biometrics. Advanced Identity Verification. Springer Verlag, London, 2000.
4. Baddeley, A. D. Working memory. Oxford University Press, 1990.
5. Dhamija, R.&Perrig, A. Dééjà vu: A User Study Using Images for Authentication. In Proceedings of 9^th USENIX Security Symposium, August 2000.
6. Fisher, M. H. Probing spatial working memory with Corsi Blocks task. Brain and Cognition 4 2001, 143--154.
7. Gong, L., Lomas, M. A., Needham, R. M. and Saltzer, J. H. Protecting poorly chosen secrets from guessing attacks. IEEE J. on Selected Areas in Communications, 11(5), 1993, 648--656.
8. Jermyn, I., Mayer, A., Monrose, F., Reiter, M. K.,&Rubin, A. D. The design and Analysis of Graphical Passwords. Proceedings of the 9^th USENIX Security Symposium, August 2000.
9. Madigan, S. Picture memory. In J. C. Yuille (Ed.), Imagery, memory, and cognition: essays in honor of Allan Paivio. Lawrence Erlbaum Associates, Hillsdale, NJ, 1983.
10. Paivio, A, Rogers, T. B.,&Smythe, P. C. Why are pictures easier to recall than words? Psychonomic Science, 11(4), 1968, 137--138.
11. Park, D. C. Ageing and memory: Mechanisms underlying age differences in performances. In Proceedings of the 1997 World Congress of Gerontology.
12. Shepard, R. N. Recognition memory for words, sentences and pictures. Journal of Verbal Learning and Verbal Behavior, 6, 1967, 156--163.
13. Vaidja, C. J. and Gabrieli, J. D. Picture superiority in conceptual memory: Dissociative effects of encoding and retrieval tasks. Memory and Cognition, 28(7), 2000, 1165--1172.
14. Yan, J., Blackwell, A., Anderson, R. and Grant, A. The memorability and security of passwords --- Some empirical results. Technical Report No. 500 2001, Computer Laboratory University of Cambridge. http://www.ftp.cl.cam.ac.uk/ftp/users/ria14/tr500.pdf.

Index Terms

• Human-centered computing

  • Accessibility

  • Human computer interaction (HCI)

    • Empirical studies in HCI

  • Interaction design

    • Interaction design process and methods

      • Interface design prototyping

      • User centered design