A new shoulder-surfing resistant password for mobile environments

In mobile devices such as smart phones, it is important to provide adequate user authentication. Conventional text-based passwords have significant drawbacks though they are used as the most common authentication method. To address the vulnerabilities of traditional text-based passwords, graphical password schemes have been developed as possible alternative solutions. However, a potential drawback of graphical password schemes is that they are more vulnerable to shoulder-surfing than conventional text-based passwords. In this paper, we present a new shoulder-surfing resistant password. Our approach makes it difficult for attackers to observe a user's password by requiring the user to locate his or her password in the given password grid instead of entering the password (Figure 1). Security analysis for shoulder-surfing attacks shows that our password is robust against both random and shoulder-surfing attacks.