Enhanced detection of regular graphical passwords in Passpoints through convex hull area analysis

Abstract

Passpoints is a graphical authentication system presented as a viable alternative to traditional methods, owing to its security, usability, and low implementation cost. It requires the user to select five ordered points in an image, the configuration fixed by the Passpoints scheme. If the points selected by a user follow a regular pattern, i.e., they repel each other, the password is not secure. The existing literature reports that statistical tests can detect such a pattern at the registration stage of this system; however, their effectiveness is limited. In this document, a new, highly effective test is proposed to detect a regular pattern in Passpoints passwords, based on the area of the convex hull formed by the five points. The reference (null) distribution of this area under complete spatial randomness is estimated by simulation and approximated by a Weibull law, whose adequacy is assessed with the Anderson—Darling, Kolmogorov—Smirnov and Chi-square goodness-of-fit tests using a parametric bootstrap, since the parameters are estimated from the same sample. Classification of an individual password is then carried out by a one-sided tail test of that single observation against the reference distribution—a discordancy test, not a goodness-of-fit test—and the Type I and Type II errors are estimated by simulation. The proposed test is compared, in effectiveness and efficiency, against the two strongest baselines in the literature: the mean-distance test and the test based on the perimeter of Delaunay triangles. On simulated password databases, the proposed test attains the highest detection rate reported to date for this pattern, reaching 87% at α = 0.05 under the lower of the two simulated regularity levels and exceeding the detection rate of previous tests by more than 50% under matched conditions, while also attaining the lowest execution time among the tests compared. These figures characterise performance on passwords generated by a spatial inhibition process; detection performance on passwords chosen by real users has not yet been measured and is the subject of ongoing work.