![](bg6.png)
the server expects a message using the same equiva-
lence class image.
4 DISADVANTAGES OF IAPS
The drawbacks are the storage and bandwidth require-
ment. As a solution, we could populate a system with
compressed images or sounds in order to reduce stor-
age consumption. Another option in the case of im-
ages might be to use vectors or fractals. This would
allow for better upwards scalability in systems that
support a large number of accounts.
A third option is that we could weaken the condi-
tion that the user’s personalized alphabets are disjunct
for any two users. It should be possible to implement
the IAP architecture and only require a low probabil-
ity that two users share a given symbol in their mutual
alphabets – This might have ramifications elsewhere,
and hence requires further research.
5 CONCLUSIONS
We modeled passwords as utilizing an infinite alpha-
bet, allowing us to devise an optimized architecture
upon which image and sound based authentication
schemes can be based. We give an example of a fea-
sible implementation of the IAP model, using images
as a password alphabet, as a result we find that al-
though modeled on infinity, the architecture can be
feasibly adapted for use in many real world scenar-
ios. The envisaged system underwent a security anal-
ysis, wherein it was found that depending upon the
nature of the alphabet used, the system is at least
as strong as a traditional alphanumeric counterpart
against social engineering and online brute force at-
tacks and more secure against replay, keylogging,
phishing, pharming, offline brute force and dictio-
nary attacks. However, when image based alphabets
are implemented, the model is weaker than traditional
passwords against the threat of remote screen capture.
It is therefore essential that any image based IAP sys-
tem also incorporate countermeasures to mitigate this
risk.
The IAP model was developed with flexibility in
mind. For this reason, it should be implementable
over a number of preferred architectures and cryp-
tographic protocols. It is hoped that the model may
prove useful to those considering future implementa-
tions of alternative authentication schemes.
REFERENCES
Boit, A., Geimer, T., and Loviscach, J. (2009). A random
cursor matrix to hide graphical password input. In
SIGGRAPH ’09: SIGGRAPH ’09: Posters, pages 1–
1, New York, NY, USA. ACM.
Davis, D., Monrose, F., and Reiter, M. K. (2004). On user
choice in graphical password schemes. In SSYM’04:
Proceedings of the 13th conference on USENIX Se-
curity Symposium, pages 11–11, Berkeley, CA, USA.
USENIX Association.
Dhamija, R. and Perrig, A. (2000). D´ej`a vu: A user study
using images for authentication. In Proceedings of
USENIX Security Symposium, pages 45–58, Denver,
Colorado.
Gaw, S. and Felten, E. W. (2006). Password manage-
ment strategies for online accounts. In SOUPS ’06:
Proceedings of the second symposium on Usable pri-
vacy and security, pages 44–55, New York, NY, USA.
ACM Press.
Gibson, M., Renaud, K., Conrad, M., and Maple, C. (2009).
Musipass: authenticating me softly with ”my” song.
In NSPW ’09: Proceedings of the 2009 workshop on
New security paradigms, pages 85–100, New York,
NY, USA. ACM.
Hayashi, E., Dhamija, R., Christin, N., and Perrig, A.
(2008). Use your illusion: secure authentication us-
able anywhere. In SOUPS ’08: Proceedings of the
4th symposium on Usable privacy and security, pages
35–45, New York, NY, USA. ACM.
ISO (2003). ISO/IEC 10646:2003 Information technology –
Universal Multiple-Octet Coded Character Set (UCS).
Klein, D. V. (1990). “foiling the cracker” – A survey of, and
improvements to, password security. In Proceedings
of the second USENIX Workshop on Security, pages
5–14.
Kuber, R. and Yu, W. (2006). Authentication using tactile
feedback. In HCI Engage 2006, Interactive experi-
ences.
Morris, R. and Thompson, K. (1979). Password secu-
rity: A case history. Communications of the ACM,
22(11):594–597.
Sasse, M. A., Brostoff, S., and Weirich, D. (2001). Trans-
forming the ‘weakest link’ — a human/computer in-
teraction approach to usable and effective security. BT
Technology Journal, 19(3):122–131.
Shannon, C. (1948). A mathematical theory of communica-
tion. The Bell System Technical Journal, 27:379–423.
The Unicode Consortium (2009). The Uni-
code Standard, version 5.2.0. Moun-
tain View, CA. ISBN 978-1-936213-00-9.
http://www.unicode.org/versions/Unicode5.2.0/.
Yan, J., Blackwell, A., Anderson, R., and Grant, A. (2004).
Password memorability and security: Empirical re-
sults. IEEE Security and Privacy, 2(5):25–31.
INFINITE ALPHABET PASSWORDS - A Unified Model for a Class of Authentication Systems
99