地圖密碼：一種以地圖為基礎的實用圖形密碼驗証

Pass-Maps:A Usable Map-Based Scheme of Graphical Password

范姜俊勛(Chun-Hsun FanChiang)

指導教授 ： 雷欽隆

國立臺灣大學/電機資訊學院/資訊網路與多媒體研究所/碩士(2008年)

https://doi.org/10.6342/NTU.2008.01815

摘要

近年來，許多圖形密碼機制被提出用來克服文字密碼的缺點。然而，先前的一些研究對於圖形密碼的分類並不一致。因此我們根據使用者輸入的動作來對這些圖形密碼作分類，其中包括點選與繪畫。這篇論文提出了一個新概念，藉由把原本空白的背景設置為地圖的方式，來結合以上兩種圖形密碼機制。所以，為了驗証使用地圖的優勢，我們將蒐集來的幾份圖片分成兩組，一組只含有地圖，另一組則為非地圖類別。實驗結果顯示，使用地圖類別所產生的大多數密碼都能有效抵抗現存的圖形字典攻擊。另外，地圖類別使用者比非地圖類別使用者在登入時耗費更少的時間並且擁有更高的成功率。由此可知，我們所提出的機制的確比先前的機制更有效地提升安全性以及可用性。

關鍵字

圖形密碼 ； 字典攻擊 ； 安全性 ； 可用性

並列摘要

In recent years, several graphical password schemes are proposed to overcome the drawbacks of text-based passwords. However, the classification of these schemes is not consistent in prior studies. Thus, we classify the existing schemes according to the events of input passwords, clicking and drawing. This thesis also provides a concept of combining the two types of graphical password schemes. We adopt maps as background pictures and conduct a user study to verify the superiority of using maps. We collected several images that are divided into two groups which contain maps and non-maps respectively. The results show that most passwords produced by maps are able to resist the present graphical dictionary attacks. Furthermore, the participants spent less time and had higher success rate to login when using maps. Based on the facts mentioned above, our scheme offers stronger security and better usability than those of the prior scheme indeed.

並列關鍵字

graphical password ； dictionary attack ； security ； usability

參考文獻

2. Van Oorschot, P. C. and Thorpe, J. “On predictive models and user-drawn graphical passwords. ACM Trans. Inform. Syst. Secur. 10, 4, Article 17, Jan. 2008.

4. Suo, X., Zhu, Y., and Owen, G. S. “Graphical passwords: A survey.” In 21st Annual Computer Security Applications Conference(ACSAC) (Dec.5-9), 2005.

6. Syukri, A. F., Okamoto, E. and Mambo, M. “A User Identification System Using System Using Signature Written with Mouse”, in 3rd Australasian Conference on Information Security and Privacy (ACISP): Springer-Verlag Lecture Notes in Computer Sience (1438), pp. 403-441, 1998.

10. Davis, D., Monrose, F., and Reiter, M. “On user choice in graphical password scheme.” In 13th USENIX Security Symposium, 2004.

11. Dhamija, R., 2000. “Hash visualization in user authentication.” In Proceedings of CHI 2000. ACM Press, New York, pp.279-280, 2000.