Enhancing Login Security: A New Authentication Schema Using Password and Image Patterns

A robust authentication system combining the strengths of password-based authentication and image pattern-based authentication

In today’s digital age, user authentication plays a crucial role in securing sensitive information and preventing unauthorized access to it. Traditional password-based authentication systems have been widely used, but they are increasingly vulnerable to brute-force attacks and other cyber threats. This has led to the development of new and innovative authentication methods that combine the best of both worlds: security and user friendliness.

In the rest of the article, we begin by presenting the proposed idea, followed by a sample deployment of the system that includes the source code. Then, we explain the algorithm and steps involved in registration and login. Additionally, we discuss the cryptographic features and strength of the system. Finally, the article concludes with the future scope and a summary of the main points.

Please note that certain portions of this article were refined by ChatGPT to enhance clarity and comprehension.

Proposed schema

One such novel authentication system is the combination of password-based authentication with image pattern-based authentication. This innovative approach requires users to set a password and create a unique image pattern as their login credentials. During the authentication process, the system prompts users to input their password (or any random text) and select the correct images from a grid of random images or upload a local png file as an image that matches their previously chosen image. The image is divided into n² grids, on which the user has to make a specific pattern by selecting the sequence of grids. In this project, we are using 16 grids consisting of 4 rows and 4 columns.

The system leverages the visual memory capabilities of users to create a robust and user-friendly authentication experience while ensuring a high level of security. This approach provides a viable alternative to traditional password-based authentication systems that are vulnerable to brute-force attacks and other cyber threats. Furthermore, the image can be selected from predefined images on the server or uploaded locally to the application as the password. The uploaded image is not stored on the backend server and is deleted immediately after the authentication process is complete. This ensures the user’s privacy is protected and their sensitive information is kept secure.

GitHub Repo

GitHub - nimishjn/hash-generator: The proposed authentication system combines traditional…

Deployed Application

Hash Generator

Hashing Algorithm

Inputs:

• Text password
• Chosen image data
• Index of grids chosen

Steps:

1. The chosen image is compressed into a 100 px by 100 px size.
2. The base 64 data of the compressed image is extracted.
   Eg: data:image/png;base64,iVBORw0KGgoAAAANSU……
3. The base 64 text is hashed using SHA512 and stored as image_hash.
4. The image_hash is split into 16 equal elements.
5. The elements corresponding to the index of the grids chosen are concatenated.
6. The above concatenated text is merged with the text password and hashed using SHA512.
7. Return the final hash from step 6.

Output:

• Final hash

Code: Implementation in TypeScript

// https://github.com/nimishjn/hash-generator/blob/main/src/utils/generator.ts
import CryptoJS from 'crypto-js';
import * as _Jimp from 'jimp';

const Jimp = typeof self !== 'undefined' ? self.Jimp || _Jimp : _Jimp;

interface props {
   imageSrc: string;
   password: string;
   gridIndexChosen: number[];
}

export const hashGenerator = async ({
   imageSrc,
   password,
   gridIndexChosen,
}: props) => {
   const finalHash = await Jimp.read(imageSrc)
       .then(async (img: any) => {
           // This first compresses the png data file into a 100x100 square using resize()
           // This gets the base 64 string of the compressed image file
           const data = await img.resize(100, 100).getBase64Async('image/png');

           // This hashes the base 64 string to give 512 bits of output
           const hash = CryptoJS.SHA512(data).toString();

           // This finds the size of each split required to map each grid (here 16 grids)
           const interval = Math.floor(hash.length / 16);

           // This extracts the hash intervals with respect to rank given by user
           const patternHash = gridIndexChosen
               .map((e) =>
                   hash.slice(
                       (e - 1) * interval,
                       (e - 1) * interval + interval
                   )
               )
               .join('');

           // This hashes the pattern hash with the password to give the final hash
           return CryptoJS.SHA512(patternHash + password).toString();
       })
       // Catch any error that occurs
       .catch((err: any) => {
           console.error(err);
       });
   return finalHash;
};

Graphical representation

Graphical representation of hashing algorithm

Steps: Registration Process

1. The user creates an account with the system and sets a password.
2. Users are prompted to select an image from a list of random images or upload a “local.png” file as an image.
3. The selected image is divided into 16 grids, and the user has to make a specific pattern by selecting the sequence of grids.
4. The selected grid is assigned a numerical sequence based on the user’s input pattern.
5. The text password, chosen image data, and index of grids chosen are sent to the hashing algorithm.
6. The hash is then stored in the database as the password.

Steps: Login Process

1. During login, the user enters their password.
2. They select the correct images from a grid of random images or upload the same local png file that was uploaded during registration.
3. The selected image is divided into 16 grids, and the user has to make a specific pattern by selecting the sequence of grids.
4. The selected grid is assigned a numerical sequence based on the user’s input pattern.
5. The text password, chosen image data, and index of grids chosen are sent to the hashing algorithm.
6. The system validates the password and the image pattern by comparing the hash values stored on the backend server with the ones generated in Step 5.
7. If the entered values match the stored values, the system grants access to the user’s account.
8. If the entered values do not match the stored values, the system denies access to the user’s account.
9. If the user fails to authenticate after a certain number of attempts, the system locks the account temporarily to prevent brute-force attacks.
10. The user can also reset their password through an OTP sent to their email address or phone number.

Cryptographic features

Hashing

The algorithm uses SHA512 hashing to generate a unique and fixed-length hash of the input data. SHA512 is a secure one-way hashing algorithm that produces a 512-bit hash value. This ensures that the password and image data are not stored in plaintext, making it difficult for attackers to reverse-engineer them.

Salting

The algorithm does not explicitly include a salt value, which is typically used to further strengthen password security by adding a unique, random value to each password before hashing. However, the concatenation of the image pattern with the password can be considered a form of salting, as it adds a unique value to the password hash.

Image compression

The algorithm compresses the chosen image into a smaller size of 100 px by 100 px, which helps reduce the size of the image data and speeds up the authentication process. However, this compression also reduces the amount of entropy in the image data, making it potentially vulnerable to attacks such as brute force or dictionary attacks.

Concatenation

The algorithm concatenates the elements corresponding to the index of grids chosen, which adds an extra layer of security to the authentication process. By doing this, the algorithm makes it difficult for attackers to guess the correct sequence of grids and elements. The concatenation process can be made more complex in future works.

Permutation

The algorithm divides the hashed value of the base 64 image data into 16 equal segments and rearranges them based on the order in which the user has inputted the pattern. Hence, it performs splitting and shuffling, which is a form of permutation. By permuting data, an encryption algorithm can make it much more difficult for an attacker to decrypt or predict the original data.

Cryptographic strength

The algorithm uses SHA512, a well-known and widely used cryptographic hashing algorithm that is currently considered secure and has a number of possible output combinations of 2⁵¹², which is an extremely large number (approximately 1.34 x 10¹⁵⁴). This provides a high level of cryptographic strength for the authentication process. Reverse engineering the hash is impossible considering the algorithm uses SHA512 for both image hashing and overall hashing.

The length of the password can be anywhere between 8 and infinity. The minimum number of combinations when using a character set of 94 printable ASCII characters (letters, digits, and symbols), the minimum number of combinations for a password of length 8, would be 94⁸, which is approximately 6.1 quadrillion.

Suppose the hacker is aware of the user's chosen image. The number of chosen grids in the pattern will range from 4 to 16. Therefore, the total number of possible patterns for n chosen grids in a 4×4 matrix can be calculated as C(16,n)×P(n), where C(16,n) is the number of ways to choose n grids out of a total of 16 grids, and P(n) is the number of permutations of the chosen n grids.

The table shows the number of possible patterns for chosen grids

Future Scope

• To exponentially increase the cryptographic strength, the number of grids can be increased. Currently, the application uses a 4x4 grid for simplicity.
• The number of images to choose from can also be increased to thousands and can be fetched from a dynamic source. However, the application uses 15 images for simplicity.
• The hash processing can be shifted to the backend for increased security, assuming that the backend is highly secure.

Conclusion

In conclusion, the proposed user authentication system that combines password-based authentication with image pattern-based authentication is a secure and user-friendly alternative to traditional authentication systems. The aforementioned algorithm makes sure that the user's chosen image pattern is safe and that attackers cannot easily guess it or brute-force it. The SHA512 hashing function provides strong cryptographic security, and the use of permutation adds an additional layer of complexity to the encryption process.

Overall, the algorithm satisfies the requirements of a robust authentication system by combining the strengths of password-based authentication and image pattern-based authentication to enhance the security of user authentication. It is important to note that no authentication system is completely foolproof, but the proposed system provides a viable alternative to traditional password-based authentication systems that are vulnerable to brute-force attacks and other cyber threats.

This article was a result of the Network and Information Security course taught at Vellore Institute of Technology, Vellore by Dr. Aswani Kumar Cherukuri.

About the author

I am a full-stack developer with over one year of experience in ReactJs, NextJs, and NodeJs. I have a passion for building software that is elegant, simple, and functional. I am not a one-trick programmer. I can build anything from the ground up and have a keen eye for design. If you have an idea, I have a web solution for you. I’ve also had conference papers and book chapters published in IEEE Xplore, Elsevier, and Springer as a data analytics researcher. Check out my portfolio below:

Nimish Jain | Portfolio Website

Let’s connect

• LinkedIn: https://www.linkedin.com/in/nimishjn
• GitHub: https://github.com/nimishjn
• Google Scholar: https://scholar.google.com/citations?user=oKBKRQ0AAAAJ
• Other links: https://links.nimish-jain.com