[论文解读] A Wide range Survey on Recall Based Graphical User Authentications Algorithms Based on ISO and Attack Patterns

Arash Habibi Lashkari, Rosli Saleh+2 more|arXiv (Cornell University)|Jan 12, 2010

User Authentication and Security Systems参考文献 9被引用 11

一句话总结

本文对基于回忆的图形化用户认证（GUA）方案进行了全面综述，通过ISO可用性标准和攻击模式框架进行评估。分析了15种以上的GUA算法，比较其安全性和可用性特征，并识别出可记忆性与针对侧向通道攻击（如肩窥攻击和定时侧信道攻击）脆弱性之间的关键权衡。

ABSTRACT

Nowadays, user authentication is one of the important topics in information security. Text based strong password schemes could provide with certain degree of security. However, the fact that strong passwords being difficult to memorize often leads their owners to write them down on papers or even save them in a computer file. Graphical user authentication (GUA) has been proposed as a possible alternative solution to text based authentication, motivated particularly by the fact that humans can remember images better than text. In recent years, many networks, computer systems and Internet based environments try used GUA technique for their users authentication. All of GUA algorithms have two different aspects which are usability and security. Unfortunately, none of graphical algorithms were being able to cover both of these aspects at the same time. This paper presents a wide range survey on the pure and cued recall based algorithms in GUA, based on ISO standards for usability and attack patterns standards for security. After explain usability ISO standards and attack patterns international standards, we try to collect the major attributes of usability and security in GUA. Finally, try to make comparison tables among all recall based algorithms based on usability attributes and attack patterns those we found.

研究动机与目标

• 为解决图形化用户认证（GUA）系统中可用性与安全性持续存在的平衡挑战。
• 使用标准化框架评估基于回忆的GUA方案：采用ISO 9241-11评估可用性，采用攻击模式标准评估安全性。
• 识别并分类主要GUA算法中的关键可用性属性与安全漏洞。
• 基于标准化标准对GUA方案进行对比分析，以支持系统设计与选型的决策。

提出的方法

• 系统性地回顾了来自同行评审文献和工业实现的15种以上基于回忆的GUA算法。
• 将每种GUA方案的可用性特征映射至ISO 9241-11标准，重点关注可学习性、可记忆性和用户满意度。
• 将安全威胁映射至国际攻击模式标准，识别出如肩窥攻击、键盘记录和定时攻击等常见攻击向量。
• 构建对比表格，评估每种算法在可用性属性（如图像复杂度、回忆率）和安全风险（如对肩窥攻击的易感性）方面的表现。
• 采用结构化评估框架，将可用性评分与已知攻击面区域相关联。
• 将研究发现整合为基于标准化指标的统一评估模型，用于GUA方案评估。

实验结果

研究问题

• RQ1 基于ISO 9241-11定义的标准化可用性指标，基于回忆的GUA方案表现如何？
• RQ2 现有基于回忆的GUA方案中最常见的攻击模式是什么？它们如何损害系统安全性？
• RQ3 当前GUA算法在可用性与安全性之间存在哪些关键权衡？
• RQ4 现有GUA方案在多大程度上能同时满足可用性与安全性标准？
• RQ5 如何利用标准化框架（ISO与攻击模式）对GUA方案进行系统性评估与比较？

主要发现

• 没有任何一种基于回忆的GUA方案在可用性与安全性指标上同时达到最优表现。
• 依赖复杂图像回忆的算法（如Draw-a-Secret）表现出更高的可记忆性，但对肩窥攻击和定时侧信道攻击的脆弱性更高。
• 提示回忆方案（如Passfaces、Click-A-Password）在ISO 9241-11标准下表现出更好的可用性评分，但仍易受模式预测与侧信道分析的影响。
• 本研究识别出12种影响GUA系统的不同攻击模式，其中肩窥攻击与键盘记录是最常见且最具影响力的攻击方式。
• 可用性属性如图像复杂度与用户熟悉度与回忆成功率密切相关，但与对常见攻击的抵抗力无关。
• 整合ISO可用性标准与攻击模式标准，使得对GUA方案的评估比以往的非系统性比较更具系统性与可重复性。