Rule-Based Password Filtering for Shoulder Surfing Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Password authentication is vulnerable to shoulder surfing attacks due to the use of short and easily memorable passwords, which can be easily reproduced by strangers observing the user inputting their password in public places.
Innovation Solution
A rule-based filtering mechanism that allows users to add dummy characters to their passwords, which are filtered out based on pre-configured rules, enhancing password security by concealing the real password from potential observers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users use short and easily memorable passwords, then ease of operation is improved, but security is worsened due to vulnerability to shoulder surfing attacks
Solution Approach 1:
The patent introduces a filtering mechanism as an intermediary between the user's password input and the authentication system. Dummy characters are inserted into the password as a mediating layer that obscures the real password from observers while allowing the authentication system to filter them out and verify the actual password. This resolves the contradiction by maintaining ease of remembering the core password while adding a security layer against shoulder surfing attacks.
Solution Approach 2:
The patent changes the parameter of password composition by adding dummy characters with specific filtering rules. The password is transformed from a simple string to a composite structure containing both real password characters and dummy characters that can be identified and removed by the filtering mechanism. This parameter change allows the password to remain memorable for the user while becoming resistant to observation-based attacks.
2Reliability
If dummy characters are added to password, then security is improved by concealing real password, but device complexity is worsened due to filtering mechanism
Solution Approach 1:
The filtering rules are prepared and stored in advance in the system. The dummy characters and their corresponding filtering criteria are pre-configured before the authentication process begins. This preliminary action allows the filtering mechanism to operate efficiently during login without adding significant real-time processing complexity, as the rules are already established and ready for application.
3Adaptability or versatility
If filtering rules are stored in user profile, then adaptability is improved for individual users, but loss of information is worsened due to additional data storage requirements
Solution Approach 1:
The filtering rules are segmented and stored individually within the user profile, allowing each user to have their own customized set of rules. This segmentation enables the system to store only the necessary filtering parameters for each user rather than maintaining a single global rule set, optimizing the balance between adaptability and storage efficiency by storing only user-specific information.
Data Source
AI summary
In an approach for a rule-based filtering system for securing password logins, a processor receives a password input on a user device. A processor determines whether the password requires filtering. Responsive to determining the password requires filtering, a processor filters characters from the password based on a set of filtering rules to create a filtered password. A processor determines whether the filtered password matches a stored password.