Graphical User-ID with Partial Match Scheme and Application for Mobile Web-Services

Transcription

1 Journal of Advances n Informaton Technology Vol. 7, No. 3, August 2016 Graphcal User-ID wth Partal Match Scheme and Applcaton for Moble Web-Servces Yusue Matsuno, Kyoj Kawagoe, and Kenta Ou Rtsumean Unversty, Shga, Japan Emal: {s0088v@ed, awagoe@s, ou@fc}.rtsume.ac.jp Moreover, we proposed a suggeston functon to mprove a regstraton success rate. In ths paper, we propose wth Partal Match. User-ID authentcaton rate of the prevously proposed was not so hgh, although ts memorablty s hgh. Because, the user remembers the shape of the trajectory, but the user does not remember whether user drew trajectory to rght place of grd. So, we propose a partal match scheme to solve ths problem. If users use our partal match scheme, when users authentcate hs/her user-id, users can authentcate by nputtng user-id whch smlar to the regstered user-id. Users don t need to correctly nput the same regstered user-id. We examned effectveness of user-id partal match scheme. Abstract In recent years, bometrc technologes for user dentfcaton are advancng rapdly. And, the tradtonal text-based user ID and password s used. It s dffcult to user to nput texts, causes much tme to nput a text. To decrease the problem, we proposed Graphcal User IDEntfer Scheme () and Graphcal user-id suggeston. Ths scheme can gve a user a user-id smlar to the user-specfed user-id when the user specfes the same user-d that has already been regstered. We showed effectveness of ncludng suggeston scheme. In ths paper, we propose a new method, called Graphcal userid wth Partal Match Scheme. Ths scheme can nput userid that s not the correct regstered user-id but smlar to t when authentcatng user-id. Index Terms authentcaton, moble web servce, user-d, partal match, graphcal password II. GRAPHICAL USER IDENTIFIER SCHEME () [1] I. INTRODUCTION Users whch use moble termnals have been ncreasng recently. In addton, moble-related technologes on CPU, memory, touch-screen, and networng devces have been progressng. A user of an nternet shoppng servce can access to the user s shoppng hstory whch s only accessble to the user. Therefore, such web servces provde users user authentcaton usng user-id and password. The tradtonal method of user dentfer nputtng of password s a text-based method. Although ths user dentfer scheme based on the user-d and password s smple and popular n PC envronment, ths scheme s not approprate for a moble user. Ths scheme has some crucal problems, when a user uses a moble devce. These are 1) t s dffcult for a moble user to nput hs/her user-d and password va a vrtual eyboard, and 2) a user freuently forgets hs/her user-d and password whch the user regstered for a specal web servce. Some password management applcaton servces are avalable to manage a par of user-d and password per a web servce. However, the par of the user-d and the password can be easly stolen and ths may cause an llegal use of such user s data. In order to solve reducng user-d nput tme and reducton of memory burden, we prevously proposed (Graphcal User IDEntfer usng Setchng) [1]. Manuscrpt receved December 23, 2015; revsed March 22, do: /jat In our prevous paper [1], we proposed a Graphcal User Identfer Scheme Usng Setchng for Moble WebServces (). There are many exstng schemes on text-based user-id. All of the text-based user-id schemes have the followng problem: 1) the more length t s, the more dffcult to remember, 2) the user-id space s large enough to dentfy an ndvdual user. Our solves these problems. Fg. 1 shows archtecture. has a user regstraton functon and user authentcaton functon. The basc archtecture of s shown n Fg. 1, n whch a user regsters ther graphcal user-id, GUID, durng the regstraton phase. The system transforms the GUID nto ts symbolc representaton, Sym-GUID. The system then checs whether there s an exstng SymGUID n the GUID database. If there s, the system suggests another GUID smlar to the user-nputted GUID. If not, the GUID s stored n the database. Durng the authentcaton phase, after obtanng a GUID from the user, the GUID s also transformed nto the Sym-GUID as n the regstraton phase. If the GUID exsts n the GUID DB, the user s reuested to nput ther password. Fg. 2 shows GUID and Sym-GUID. We conducted evaluaton experment to ascertan effectveness of. We compared a conventonal text-based user-id scheme (randomly generated 7 characters) and. Also, we recruted ten partcpants to jon the three experments. EX1: Success rate measurement EX2: The tme reured for the GUID nput s measured

2 Journal of Advances n Informaton Technology Vol. 7, No. 3, August 2016 EX3: Memorablty chec (the success rate measurement was conducted on the three days after EX1) Fgure 2. GUID and Sym-GUID Fgure 1. archtecture Results of evaluaton s shown n Table I. obtaned a hgh success rate than text-based user-id scheme. Also, reured shorter nput tme than text-based user-id scheme. Furthermore, memorablty of was superor to the text- based user-id. TABLE I. RESULT OF EVALUATION Text-based user-id EX1 93.3% 96.7% EX sec sec. EX3 83.3% 66.7% Moreover, n our prevous paper [2], we proposed user-id suggeston functon. When the user-id to be regstered has been already regstered, user-id smlar to that the user would le to regster s recommended to the user. Addton-based suggeston (ADD-Suggest) Detour-based suggeston (DETOUR-Suggest) Pattern-based suggeston (PATTERN-Suggest) Fg. 3 and Fg. 4, Fg. 5 are example of suggest functon. We conducted evaluaton experment to show effectveness of user-id suggeston functon. We compared Wth Suggeston Scheme and Wthout Suggeston Scheme. Moreover, we conducted the followng two experments. EX1: Regstraton success rate EX2: Inputtng tme of GUID The result of experments s shown n Table II. Wth Suggeston Scheme s regstraton success rate s hgher than Wthout Suggeston Scheme s. Also, the dfference of nputtng tmes s small. Therefore, there seems to be no dfference. Then, we confrmed the effectveness of our Suggeston Functon. Fgure 3. ADD-Suggest III. PARTIAL MATCH SCHEME In ths paper, we focus on wth Partal Match Scheme. Ths scheme can authentcate user-id that s smlar to the regstered user-id when users authentcate user-id. Formally, s descrbed as follow. Assume that there s the GUID database DB = d, where d s a trplet of GUID, g, Sym-GUID s and user profle u for each user. s s obtaned usng a transformaton functon F () for g that s g = F ( g ). The nverse transformaton F 1 ( s ) s an approxmaton of g. Support that a user wants to regster g, the s s obtaned from F ( g ). The s s whether there exsts an s or not, such that dstance ( s, s ) 1, for s DB. If not exsts, then the trplet of ( g, s, u ) are TABLE II. RESULT OF EVALUATION EX1 EX2 Wth Suggeston Scheme 86.8% 5.30 sec. added to DB. If s exsts, g ' s constructed and suggested to the user. Ths functon s name s Suggeston Functon. Wthout Suggeston Scheme 73.6% 4.52 sec. 162

3 Journal of Advances n Informaton Technology Vol. 7, No. 3, August 2016 Fgure 4. DETOUR-Suggest Fgure 5. PATTERN-Suggest Suggeston Functon suggests user-id whch s resemble orgnal to users. Usng Suggest Functon user- ' ' ID s g. g g. In the authentcaton phase, gven the user nput GUID s g, s = F ( g ) s obtaned. Then, the s checed as dstance( s, s ) p 1 for exsts, then the obtaned s p s DB. If p s the user GUID, followed by password nput. Next, we explan wth Partal Match. the grds of 6 * 6 are used. A User draws a trajectory on the grds. Moreover, stored the trajectory n user-id database as ts user-id. To store the shape of the trajectory drawn by the user s easy to user because the shape may be meanngful for only the user. However, t s dffcult to correctly remember the poston of the trajectory drawn by the user. The user fals to authentcate the user-id by not be able to nput the user- ID precsely. We propose wth Partal Match n order to solve ths problem. Partal match scheme can authentcate user-id that s smlar to the regstered user-id when authentcatng. User-ID that s smlar to the regstered user-id s a user- ID that has shfted the regstered user-id up, down, left, or rght. When the user regsters the user-id, the system saves the user-id that the user drew and the user-id smlar to the user-id that the user has drawn n the database. As a result, after the users regster the user-id one tme, the system wll regster the fve user-id n the database. Then, when the users feel that the poston of the regstered user-id s ambguous, user can authentcate the user-id. However, the system f you have regstered fve user-id n the database, the problems occur. In that case, the sum of the user-id that the system can be regstered n the database s reduced. were usng a grd of 6 * 6. 's user- 10 ID space of that tme s10. In a method of partal match, the sze of the grd changes to 7 * 7 n order to ncrease the total of the user-id whch can be regstered n the database. Partal Match Scheme s user-id space of that tme s Fg. 6 shows one example of Partal Match Scheme. The left fgure of Fg. 6 shows user s regstered user-id. The rght fgure of Fg. 6 shows user-id that s smlar to regstered user-id. If users draw rght trajectory shown n Fg. 6, system can authentcate user-id. Formally, Partal Match Scheme s descrbed as follow. Assume that there s smlar GUID = h, smlar Sym- GUID t. h = g (x+1, y), g (x-1,y), g (x, y+1), g (x, t = s (x+1, y), s (x-1,y), s (x, y+1), s (x, y-1). In y-1). regstraton phase, the user draws g. When system regster g, at the same tme the system wll regster theh. Also, system regster s, at the same tme the system wll regster the t. Then, system save s and t n DB. In the authentcaton phase, the user draws g. User can authentcate g, by drawng g or h. So that, f the user can reproduce s or t, the user can authentcate u. IV. EVALUATION EXPERIMENT In ths secton, we descrbe evaluaton experments and ther results to show effectveness of our Partal Match Scheme. and wth Partal Match were mplemented on Androd 4.3 devces usng JAVA. Frst, we checed regstraton success rate, meanng how much the GUID s successfully regstered. Second, we checed authentcaton success rate, meanng how much the GUID s successfully authentcated. Thrd, the tme for nputtng GUID s measured. These tass were conducted by each of subjects three tmes. Partal match scheme s compared wth the. 163

4 Journal of Advances n Informaton Technology Vol. 7, No. 3, August 2016 Fve partcpants were recruted to jon n these experments. Each partcpant frst regstered hs/her GUID. These length values were chosen to create the same user-id space. Each partcpant nput hs/her GUID three tmes n the user authentcaton phase. At that tme, regstraton success rate of Wth Partal Match Scheme s 73.4%, and that of s 66.8%. Regstraton success rate of Wth Suggeston Scheme s hgher 6.6% than regstraton success rate of. From the frst experment, usng Partal Match Scheme s not awward to use for users to regster hs/her own user-id. B. Experment of Authentcaton Success Rate We measured user authentcaton rate of the user-id for both the and Partal Match Scheme after 3 days. We have measured the user authentcaton rate n order to chec whether there to change the memorablty when usng the partal match. Then, we compared G of user-id authentcaton rate to a Partal Match Scheme's user-id authentcaton rate. Here, length of the trajectory was defned as In addton, the user so that the user can easly remember the trajectory drew your ntals. The result of experment s shown n Table IV. TABLE IV. RESULT OF AUTHENTICATION SUCCESS RATE Fgure 6. Example of partal match scheme (Left: regstered user-id, Rght: smlar regstered user-id) We measure the authentcaton success rate. The average nput tme s then calculated by aggregatng all the nput tme for authentcatons. Also, n advance, we saved one mllon user-id n database. Moreover, we confrmed the change of regstraton success rate of the user-id usng the Partal Match Scheme by changng the number of grds from 6*6 to 7*7. We conducted three experments. These are experments of measurng regstraton success rate, authentcaton success rate and nput tme. Therefore, fve user ID s regstered n one tme regstraton. A. Experment of Regstraton Success Rate If we used Partal Match Scheme, system saves regstered user-id and smlar regstered user-id n regstraton phase. As a result, sum of regstrable user-id whch s usng Partal Match Scheme s fewer than 's. Therefore, the regstraton success rate of the user-id usng the Partal Match Scheme decreases. We changed the number of grds from 6*6 to 7*7 n order to solve ths problem. As a result, we ncreased the total number of user-id that can be regstered by the user-id usng the Partal Match Scheme. The result of experment s shown n Table III. TABLE III. RESULT OF REGISTRATION SUCCESS RATE wth Partal Match scheme Partcpant Regstraton Success Rate Regstraton Success (%) Rate (%) A B C D E Average Table III shows that GUID regstraton success rate usng Partal Match Scheme and. Average Wth Partal Match Scheme Partcpant Authentcaton Success Rate (%) A 0 0 B C D E Average Sgnfcant dfference 0.81 Authentcaton Success Rate (%) Table IV shows that GUID authentcaton success rate usng Partal Match Scheme and. Average authentcaton rate n the case of usng the Partal Match Scheme was 66.8%. Average authentcaton rate n the case of was 66.8%. Average authentcaton rate of Partal Match Scheme s 6.6% less than the. Here, we measured a sgnfcant dfference by Welch's t- test. The results was 0.81 > Namely, we found that there s no sgnfcant dfference. Therefore, t says that memorablty s no change. C. Experment of Input Tme We measured nput tme of the user-id for both the and Partal Match Scheme. We compared the tme of Partal Match Scheme and the tme of n order to chec whether there to change the user's worload when usng the Partal Match Scheme. The result of experment s shown n Table V. TABLE V. RESULT OF INPUT TIME wth Partal Match Scheme Partcpant Input Tme(sec.) Input Tme(sec.) A B C D E Average Sgnfcant 0.32 dfference 164

5 Journal of Advances n Informaton Technology Vol. 7, No. 3, August 2016 Table V shows that GUID nput tme usng Partal Match Scheme and. Average nput tme n the case of usng the Partal Match Scheme was 7.91 sec. Average nput tme n the case of was 5.88 sec. Average nput tme of Partal Match Scheme s 2.03 sec. more than the. Here, we measured a sgnfcant dfference by Welch's t-test. The results was 0.32 > Namely, we found that there s no sgnfcant dfference. Therefore, t says that reducton of the user's worload s no change. V. UESR AUTHERNTICATION IN MOBILE WEB APPLICATIONS In ths chapter, we explan applcatons of. s the nput method of the user-id of the moble termnal. Here, we descrbe to be used as the Web Applcaton as an applcaton example of. We use at the nput of the user-id, use the graphcal password at the nput of the password. Fgure 9. User authentcaton screen of Fgure 7. Top page for logn to the web ste There s logn screen to the Web ste, as shown n Fg. 7. Frst, the user presses a user regstraton button. After that, the screen shfts to the user regstraton screen of, as shown n Fg. 8. Then, the user draws a user- ID whch you want to regster. In ths case, f the user ID that the user regstraton has already been regstered, the prevously proposed Suggest Functon s used. Then, the system can suggest a new user-id to the user. Next, the user presses a user authentcaton button. Then, as shown n Fg. 9, the screen shfts to a user authentcaton screen of. In addton, user draws a trajectory that the user has regstered. Here, t s possble to mprove the authentcaton rate by utlzng the proposed partal match method. Fgure 10. OBIR password nput screen Fgure 8. User regstraton screen of Then, after drawng the user-id, the screen shfts to the password nput screen as shown n Fg. 10. Ths tme OBIR [3] s beng used as a graphcal password n the password entry screen. If the password s nputted, the screen shfts my page as shown n Fg

6 Journal of Advances n Informaton Technology Vol. 7, No. 3, August 2016 In the future, we wll mprove Partal Match Scheme to become hgher authentcaton success rate. In addton, we wll create a web applcaton usng the and Suggest Functon and Partal Match Scheme. In addton, we wll examne the effectveness of our research. ACKNOWLEDGMENT Ths wor was partally supported by JSPS Grant Number and MEXT-Supported Program for the Strategc Research Foundaton at Prvate Unverstes Ths wor was partally supported by MEXTSupported Program for the Strategc Research Foundaton at Prvate Unverstes REFERENCES [1] [2] Fgure 11. Screen of authentcaton [3] VI. RELATED WORK Although our method proposed here s not a graphcal password scheme, many graphcal password schemes has been studed for the last decade [4]. Graphcal password s classfed as drawng-based and selecton-based schemes. The typcal examples n the frst category are Draw-a-secret (DAS) [5], TMD [6], TMO [7], and PassGo [8], whle the second category ncludes Passpont [9]. Many graphcal passwords are manly proposed to prevent a user from dctonary attacs and shouldersurfng attacs. None of the graphcal passwords can be used as replacement of user-id. Despte developments of the graphcal passwords as well as those of the user authentcaton framewors, no user-id schemes as a replacement of text-based user-id have yet been proposed, especally approprate for moble users. [4] [5] [6] [7] [8] [9] VII. CONCLUSION In ths paper, we proposed user-id authentcaton processng scheme, called Partal Match Scheme. We were sure effectveness of Partal Match Scheme. We compared the user-id regstraton success rate, authentcaton success rate and nput tme of Partal Match Scheme and. Moreover, there was a lttle bt dfference of Partal Match Scheme and on the nput-tme and authentcaton success rate. As a result, t s shown that our Partal Match Scheme s effectve to authentcatng user-id. 166 Y. Matsuno, H. H. Huang, Y. Fang, and K. Kawagoe, : A graphcal user dentfer scheme usng setchng for moble web-servces moblehc2014, Poster, pp , Toronto, Sept Y. Matsuno, H. H. Huang, Y. Fang, and K. Kawagoe, A graphcal user dentfer suggeston functon scheme usng setchng for moble web-servces, n Proc. Internatonal MultConference on Engneers and Computer Scentsts, IAENG Internatonal Conference on Internet Computng and Web Servces, Hong Kong, March 2015, pp , pp C. X. Nguyen, H. H. Huang, and K. Kawagoe, Implementaton and evaluatons of graphcal password usng object-based mage ranng, Internatonal Journal of Computer Systems Scence and Engneerng, vol. 29, no. 4, pp R. Bddle, S. Chasson, and P. C. V. Oorschot, Graphcal passwords: Learnng from the frst twelve years, Acm Comput. Surv., vol. 44, no. 4, pp. 1-41, August I. Jermyn, A. Mayer, F. Monrose, M. K. Reter, and A. D. Rubn, The desgn and analyss of graphcal passwords, n Proc. the 8th Conference on USENIX Securty Symposum, Bereley, CA, USA, USENIX Assocaton, vol. 8, 1999, pp H. Y. Chang and S. Chasson, Improvng user authentcaton on moble devces: A touchscreen graphcal password, n Proc. MobleHCI 13, 2013, pp D. Luca, et al., Touch me once and I now t s you: Implct authentcaton based on touch screen patterns, n Proc. ACM CHI 12, 2012, pp H. Tao and C. Adams, Pass-go: A proposal to mprove the usablty of graphcal passwords, Int. J. Networ Securty, vol. 7, no. 2, pp , S. Wedenbec, J. Waters, J. C. Brget, A. Brodsy, and N. Memon, PassPonts: Desgn and longtudnal evaluaton of a graphcal password system, Int J Human-Computer Studes, vol. 63, pp , Yusue Matsuno s a graduate student at Rtsumean Unversty. Hs research nterest ncludes Databases and Moble-computng. Hs research of the current s graphcal user-id. Kenta Ou, PhD, s a lecturer at Rtsumean Unversty. Hs research nterest ncludes Recommender Systems and Web Intellgence. Kyoj Kawagoe, PhD., s a professor at Rtsumean Unversty. Hs research nterest ncludes Databases, Informaton Retreval, and Data Scence.