SGP: A Safe Graphical Password System Resisting Shoulder-Surfing Attack on Smartphones

Graphical passwords have been taken as a potential alternative to alphanumeric passwords. Graphical password based authentication is widely used in many applications for system security and privacy. It increases ease of password use i.e., memorability of the password. With the rapid development of mobile devices, graphical passwords have already been implemented on smartphones. However, shoulder-surfing attack is a major threat to the security of graphical password systems. To overcome this problem, we proposed a novel graphical password authentication system, SGP. SGP uses a pattern of digits for the input of graphical password images. This pattern changes the position of input images in each authentication session. SGP prevents shoulder-surfing attacker to derive which password images are used by the user, even if the attacker records a complete login process. SGP does not use any secondary channels to resist shoulder-surfing attack.