1

1. INTRODUCTION

AUTHENTICATION is a process of validating who you are to whom you claimed to be, or in

other words a process of identifying an individual, usually based on a username and password.

Currently what we have in the field, are the following set of techniques:

Human Authentication Techniques are as follows:

Knowledge Base (What you know)

Token Based(What you have)

Biometrics(What you are)

Recognition Based(What you recognize)

Computer Authentication Techniques are as follows:

Textual Passwords

Graphical Passwords

Biometric schemes (fingerprints, voice recognition etc.)

We are provided with many password types such as textual passwords, biometric scanning,

tokens or cards (such as an ATM card) etc. But there are many weaknesses in current authentication

systems. The most common computer authentication method is to use alphanumerical usernames and

passwords. One of the main problems is the difficulty of remembering passwords.

Graphical passwords can also be used. One of the main arguments for graphical passwords is

that pictures are easier to remember than text strings. Preliminary user studies presented in some

research papers seem to support this. However, current user studies are still very limited, involving

only a small number of users. We still do not have convincing evidence demonstrating that graphical

passwords are easier to remember than text based passwords[3.4].

2

The dramatic increase of computer usage has given rise to many security concerns. One major

security concern is authentication, which is the process of validating who you are to whom you claimed

to be. In general, human authentication techniques can be classified as:

Knowledge Based - What you KNOW

Human Authentication Token Based -What

techniques

you HAVE

Biometrics - What you ARE

Textual Password

Graphical Password

ATM cards

Keys

ID cards

Fingerprints, Palmprints

Hand geometry

Face, Iris, Voice,

Retina recognition

3

2.THE 3-D PASSWORD SCHEME

The 3D Password scheme is a relatively new authentication scheme that combines

RECOGNITION +RECALL + TO-KENS+ BIOMETRIC in one authentication system. The 3-D

password is a multifactor authentication scheme. It can com-bine all existing authentication

schemes into a single 3-D virtual environment. This 3-D virtual environment contains several

objects or items with which the user can interact. The type of interaction varies from one item to

another. The 3-D password is constructed by observing the actions and interactions of the user and

by observing the sequences of such actions[8]. It is the user’s choice to select which type of

authentication techniques will be part of their 3-D password.

This is achieved through interacting only with the objects that acquire information that the

user is comfortable in providing and ignoring the objects that request information that the user

prefers not to provide. For example, if an item requests an iris scan and the user is not comfortable

in providing such information, the user simply avoids interacting with that item. Moreover, giving

the user the freedom of choice as to what type of authentication schemes will be part of their 3-D

pass-word and given the large number of objects and items in the environment, the number of

possible 3D passwords will in-crease. Thus, it becomes much more difficult for the attacker to

guess the user’s 3-D password.

2.1 System Implementation

Since the 3D password is a multifactor authentication scheme [8], it presents a 3D virtual

environment containing various virtual objects. The user navigates through this environment and

interacts with the objects. The 3D password is simply the combination and the sequence of the

user interactions that occur in the 3D virtual environment[4,6]. The 3D password can combine

recognition, recall, token, and biometrics based systems into one authentication scheme.

This can be done by designing a 3D virtual environment that contains objects that request

information to be recalled, information to be recognized, tokens to be presented, and biometric

data to be verified.

4

Virtual objects can be any object that we encounter in real life. Any obvious actions and

interactions towards the real life objects can be done in the virtual 3D environment toward the

virtual objects. Moreover, any user input (such as speaking in a specific location) in the virtual 3D

environment can be considered as a part of the 3D password. We can have the following virtual

objects, for instance:

1. A keyboard wherein the user can type.

2. A fingerprint reader that requires the user’s fingerprint.

3. A biometric recognition device.

4. A paper or a white board that a user can write, sign or draw on.

5. An ATM machine that requires a smart card and PIN.

6. An appliance that can be switched on/off.

7. A television or radio where channels can be selected.

8. A staple that can be punched.

2.2 Working

Consider a three dimensional virtual environment space that is of the size S×S×S. Each

point in the three dimensional environment space represented by the coordinates (x, y, z) € [1..S]

× [1..S]×[1..S]. The objects are distributed in the three-dimensional virtual environment. Every

object has its own (x,y,z) coordinates. Assume the user can navigate and walk through the three-

dimensional virtual environment and can see the objects and interact with the objects[7]. The input

device for interactions with objects can be a mouse, a keyboard, stylus, a card reader, a microphone

etc.

5

For example, consider a user who navigates through the 3D virtual environment that

consists of a ground and a classroom. Let us assume that the user is in the virtual ground and the

user turns around to the door located in (10,16,80) and opens it. Then, the user closes the door.

The user types "WAFFLE" into a computer that exists in the position of (18, 5, 20). The user then

walks over and turns off the light located in (15, 6, 20), and then goes to a white board located in

(55, 3, 30) and draws just one dot in the (x,y) coordinate of the white board at the specific point of

(420,170). The user then presses the login button. The initial representation of user actions in the

3D virtual environment can be recorded as follows:

(10, 16, 80) Action = Open the office door;

(10, 16, 80) Action = Close the office door;

(18, 5, 20) Action = Typing, “W”;

(18, 5, 20) Action = Typing, “A”;

(18, 5, 20) Action = Typing, “F”;

(18, 5, 20) Action = Typing, “F”;

(18, 5, 20) Action = Typing, “L”;

(18, 5, 20) Action = Typing, “E”;

(15, 6, 20) Action = Turning the Light Off;

(55, 3, 30) Action = drawing , point = (420,170);

After the user has performed these actions, he will exit out of the 3-D environment. After

backend verification, access will be granted.

6

Figure 2 – (a) Snapshot of a proof-of-concept 3-D virtual environment, where the user is typing

a textual password on a virtual computer as a part of the user’s 3-D password. (b) Snapshot of a

proof-of-concept virtual art gallery, which contains 36 pictures and six computers

7

3.INTRODUCING THE FOURTH DIMENSION

The 4-D Password scheme is an attempt to make the existing scheme even more robust and

powerful. We propose to add another key to the current scheme, and this will lend more stability

and make the attacks on user privacy even more difficult to succeed in.

This key, what we propose to refer to as the ‘FOURTH DIMENSION’ would be an

encrypted string that encapsulates a gesture that the user is supposed to make with his hands, in

front of a webcam, apart from his password. This will help ensure that the user is physically present

for login.Hence, the final password of the user would be[9]:

Hand Gesture + 3-D Password .

Now let’s have a closer look as to how this gesture would be generated and saved. We have

a mapping function F(x), such that if we put V as the input string, then it creates F(V), which is

our final encrypted key. The user does not need to bother with any of these. .All he needs to do is

remember the gesture, which would be captured as a binary string S. This would be saved as a

precursor to his 3-D password. The String V would then be encrypted and appended to the already

existing password. Hence, the end result would be a password that looks like this:

P = 3-D password + F(V).

The addition of F(V) at the end would actually increase the complexity of the password.

The attacker will now have to guess the string V as well as try to decipher function F(x), in addition

to the complex techniques required to decipher a user’s 3-D password itself.

8

Figure 2 – State diagram of 4-D password

3.1 Signup Process

Consider a web-based repository of research work for scientists, wherein each scientist has

his own account which stores his files and folders. This repository employs the 4-D password

scheme.

As a new user, I will sign up as follows:

1. Choose a username.

2. I will be redirected to the password generation page.

3. I will enter the 3-D environment.

9

4. Inside the environment, I will perform certain actions, as have been discussed before.

5. I will exit out of the environment and submit my actions.

6. I will then be asked to perform a gesture in front of the webcam. This gesture, once

successfully captured, will be saved. I will be notified of the time that I had taken to

perform this gesture this time.

7. I will need to remember it for subsequent attempts at login Sign up process is complete.

3.2 Logging In

Now when I log in, I will have to enter my username, and then perform my gesture. Once

this is submitted and verified, I will enter the 3-D environment and perform my password. I will

exit and submit it. Once that is verified, will be granted access to my account.

3.3 Significance

The addition of an extra gesture will create an unlimited host of password combinations.

Also it will ensure that there is a person attempting to login, and not some automated program, or

bot.

Another check that can be applied here, is the measure of the total time taken for the 3D

Authentication by the user. This time can be considered a part of the user’s authentication, and the

user must perform subsequent attempts within the same time limit, give or take a few more

seconds. So each password can then have a time window associated with it.

On later attempts, a timer can be made to run in parallel to the 3-D browsing session. Based on the

total time taken, certain conclusions can be drawn out:

1. If time taken tends to zero, it might be an attempt made by an automated hacking

process.

2. If time taken is very large, it may well be possible that another user is attempting

to replicate the user’s actions, step by step.

This additional check will provide more soundness to the 4-D password scheme

10

4.SECURITY ANALYSIS

To analyse and study how secure a system is, we have to consider how hard it is for the

attacker to break such a system. A possible measurement is based on the information content of a

password space, which is defined in [13] as “the entropy of the probability distribution over that

space given by the relative frequencies of the passwords that users actually choose.” We have seen

that textual password space may be relatively large; however, an attacker might only need a small

subset of the full password space as Klein [2] observed to successfully break such an authentication

system. As a result, it is important to have a scheme that has a very large possible password space

as one factor for increasing the work required by the attacker to break the authentication system.

Another factor is to find a scheme that has no previous or existing knowledge of the most probable

user password selection, which can also resist the attack on such an authentication scheme.

Figure 4 - Password space of the 3-D password, textual password, Passfaces, and DAS with grid

sizes of 5 × 5 and 10 × 10.

4.1 3-D Password Space Size

One important factor to determine how difficult it is to launch an attack on an

authentication system is the size of the password space. To determine the 3-D password space, we

have to count all possible 3-D passwords that have a certain number of actions, interactions, and

inputs toward all objects that exist in the 3-D virtual environment.

11

We assume that the length of the 3-D password is Lmax, and the probability of the 3-D

password of size greater than Lmax is zero. To measure the 3-D password space, we will calculate

Π (Lmax, G) on a 3-D virtual environment that has the space (G x G x G) for a 3-D password of a

length (number of actions, interactions, and inputs) of Lmax or less.

In the following expression, AC represents the possible actions toward the 3-D virtual

environment, whereas Π represents the total numbers of possible 3-D passwords of length Lmax or

less:

In the following expression (2), Omax is the number of objects in the 3-D virtual

environment:

Where xi = xj, yi = yj, and zi = zj, only if i = j. The design of the 3-D environment will

determine the value of Omax. The variable m represents all possible actions and interactions toward

all existing objects Oi. However, g(AC) counts the total number of actions and inputs toward the

3-D virtual environment, whereas m, as we mentioned before, counts the actions and interactions

toward the objects. An example of g(AC) can be a user movement pattern, which can be considered

as a part of the user’s 3-D password.

The function is the number of possible actions and interactions toward the object Oi based

on the object type Ti. Object types can be textual password objects, DAS objects, or any

authentication scheme.

12

The function f is determined from the object type. It counts the possible actions and

interactions that the object can accept. If we assume that an object “Keyboard” is in location (x0,

y0, z0) of type = textual password, f will count the possible characters and numbers that can be

typed, which is around 93 possibilities. As we mentioned before, an object type is one of the

important factors that affects the overall password space. Therefore, higher outcomes of function

f mean larger 3-Dpassword space size.

Figure 5 - Password space of the 3-D password, textual password, Passfaces, and DAS with

grid sizes of 5 × 5 and 10 × 10. Length is the number of actions and interactions for a 3-D

password, the number of characters for textual passwords, the number of selections for

Passfaces, and the number of points that represent the strokes for DAS.

13

Figure 6 - observing the number of possible actions/interactions of a 3-D password within a 3-

D environment specified in Section V-A compared to the two critical points of textual

passwords. Point

“a” is the bit size of Klein [2]

(3 × 106) dictionary of eight-character textual passwords.

Point “b” represents the full password space of eight-character textual

passwords.

Point “a” shows that by having only two actions and interactions as a 3-D password, the 3-

D password exceeds the number of textual passwords used by Klein [2] to break 25% of textual

passwords of eight characters. Point “b” represents the full textual password space of eight

characters or less. It shows that by performing only four interactions, actions, and inputs as a 3-D

password, the 3-D password space exceeds the full textual passwords of eight characters or less.

From the previous equations, we observe that the number of objects and the type of actions

and interactions determines the probable password space. Therefore, the design of the 3-D virtual

environment is a very critical part of the 3-D password system. Figs. 4 and 5 illustrate the resulting

password space of the proposed 3-D password compared to textual password, Passfaces, and DAS

of a grid of 5 x 5 and 10 x 10, respectively. Notice the difference between a 3-D passwords built

on a simple 3-D virtual environment compared to the other authentication schemes.

14

4.2 3-D Password Distribution Knowledge

Studying the user’s behavior of password selection and knowing the most probable textual

passwords are the key behind dictionary attacks. Klein [2] used such knowledge to collect a small

set of 3 x 106 words that have a high probability of usage among users. The question is how has

such information (highly probable passwords) been found and why. Users tend to choose words

that have meaning, such as places, names, famous people’s names, sports terms, and biological

terminologies. Therefore, finding these different words from the dictionary is a relatively simple

task. Using such knowledge yields a high success rate for breaking textual passwords. Any

authentication scheme is affected by the knowledge distribution of the user’s secrets. According

to Davis et al. [9], Passfaces [8] users tend to choose faces that reflect their own taste on facial

attractiveness, race, and gender. Moreover, 10% of male passwords have been guessed in only two

guesses. Another study [14] about user selection of DAS [13] concluded that for their secret

passwords, users tend to draw things that have Meaning, which simplifies the attacker’s task.

Currently, knowledge about user behaviors on selecting their 3-D password does not exist.

Every user has different requirements and preferences when selecting the appropriate 3-D

password. This fact will increase the effort required to find a pattern of user’s highly selected 3-D

password. In addition, since the 3-D password combines several authentication schemes into a

single authentication environment, the attacker has to study every single authentication scheme

and has to discover what the most probable selected secrets are. For textual password, the highly

probable selected textual password might be determined by the use of dictionaries. However, there

are many authentication schemes with undiscovered probable password space.

Since every 3-D password system can be designed according to the protected system

requirements, the attacker has to separately study every 3-D password system. This is because

objects that exist in one 3-D password system might not exist on other 3-D password systems.

Therefore, more effort is required to build the knowledge of most probable 3-D passwords.

15

4.3 Attacks and Countermeasures

To realize and understand how far an authentication scheme is secure, we have to consider all

possible attack methods. We have to study whether the authentication scheme proposed is immune

against such attacks or not. Moreover, if the proposed authentication scheme is not immune, we

then have to find the countermeasures that prevent such attacks. In this section, we try to cover

most possible attacks and whether the attack is valid or not. Moreover, we try to propose

countermeasures for such attacks.

1. Keylogger:- In many cases, the attacker installs an invisible software called a keylogger,

which is designed to capture all keys typed through the user’s keyboard and output them

as a stream in a text file. This way the attacker finds out the user’s password by browsing

through the file. But here, since the nature of pass-word is not textual, this attempt will be

a total failure.

2. Well Studied Attack:- The attacker tries to find the highest probable distribution of 3D

passwords. In order to launch such an attack, the attacker has to acquire knowledge of the

most probable 3D password distributions. This is very difficult because the attacker has to

study all the existing authentication schemes that are used in the 3D environment. It

requires a study of the user’s selection of objects for the 3D password. Moreover, a well

studied attack is very hard to accomplish since the attacker has to perform a customized

attack for every different virtual environment design. This environment has a number of

objects and types of object responses that differ from any other 3D virtual environment.

Therefore, a carefully customized study is required to initialize an effective attack. Even

then, the probability of a successful attack is extremely scarce.

With a 4-D password, there is the extra process of determining the gesture as well. The

chances that an attacker can guess the gesture, out of thousands of possible human

movements, is going to be as hard as it sounds. Plus, both the gesture and the 3-D password

need to guessed correctly. So chances of a successful attack in this case are bleak, to

mention the least.

16

3. Shoulder Surfing Attack:- An attacker uses a camera to record the user’s 3D password

or tries to watch the legitimate user while the 3D password is being performed. This attack

is the most successful type of attack against 3D passwords and some other graphical pass-

words. However, the user’s 3D password may contain biometric data or textual passwords

that cannot be seen from behind.

Therefore, we assume that the 3D password should be per-formed in a secure place where

a shoulder surfing attack can-not be performed. Also, with the 4-D password, the nuances

of the gesture, even if visible to the attacker, may not be emulated successfully, and also

the physique will have to match with the user, since the system would compare it with the

earlier recording.

4. Timing Attack:- The Attacker observes how long it takes the legitimate user to perform

correct log in using 3D Password which gives an indication of 3-D Passwords length. This

attack cannot be successful since it gives the attacker mere hints. Also this would lend the

attacker no help in finding out the extra gesture; which is exclusive of the 4D password

only.

5. Bruteforce Attack:- The attack is very difficult because

1) Time required to login The total time needed for a legitimate user to login may vary

depending on the number of interactions and actions, the size of the 3D virtual

environment, and the type of actions and interactions. Therefore, a brute force attack on a

3D password is very difficult and time consuming.

2) Cost of attacks the 3D virtual environment contains biometric recognition objects and

token based objects. The attacker has to forge all possible biometric information and forge

all the required tokens. The cost of forging such information is very high, therefore

cracking the 3D password is more challenging. The high number of possible 3D password

spaces leaves the attacker with almost no chance of breaking the 3D password.

17

5. ADVANTAGES OF 4-D PASSWORD

1. Flexibility: 4D Passwords allows Multifactor Authentication. Biometric, graphical and

textual passwords can be embedded in 4D password tech-nology.

2. Strength: This scenario provides almost unlimited passwords possibility. Hence, the

strength.

3. Easy to Remember: Can be remembered in the form of short story.

4. Privacy: Organizers can select authentication schemes that respect the user’s privacy.

18

6. APPLICATION

1. Critical Server :- Many organizations are using critical servers which are protected by a

textual password. 4D password authentication scheme proposes sound re-placement for these

textual passwords.

2. Banking :- Almost all the Indian banks started 3D Password service for security of buyer who

wants to buy online or pay online. ”How to Create 3D pass-word for my master card? Our

online payment will fail, if will create 3D password, so for generating 3D password, we have

to go to our bank's website and then, click 3D secure service and then write our card number,

CVV, pin no., and write our password and rewrite it and then click ok or submit.” After this

we get a ‘thank you’ message. Like PNB, SBI also started .

3D secure services for verified by Visa. Verified by Visa is a new service that will let you

use a personal password with your State Bank of India Visa card, giving you added assurance

that only you can use your State Bank of India Visa card to make purchases over the Internet.

3. Nuclear and military facilities :- 4D password has a very large password space and since it

combines RECOGNITION+ RECALL+ TOKENS+ BIO-METRIC in one authentication

system, it can be used for providing security to nuclear and military facilities.

4. Airplanes And Jetfighters :- Since airplanes and jetplanes can be misused for religion and

political agendas, they should be protected by a powerful authentication scheme.

5. The Cloud :- Cloud computing is an internet-based model for enabling convenient, on-

demand network access to a shared pool of configurable computing resources. It provides

various services over internet such as software, hardware, data storage and infra-structure.

Cloud computing providers deliver the applications via internet, which are accessed from web

browsers, desktop and mobile apps. The 4D password scheme, if successfully implemented

here can make the cloud much more safer and reliable.

6. In ATM , Web authentication , Digital Computer and Laptop also.

19

7.FUTURE WORK AND ANALYSIS

Cloud computing provides various internet-based, on demand services like software,

hardware, server, infrastructure and data storage. To provide privacy services to the

intended customer, it is a better option to use sophisticated and robust password generation

and authentication technique. A state of the art technique would ensure that the strict

authentication and authorization is possible. The security levels of cloud environment can

be further improved by multi-level of authentication. This is the future work of our research.

Our future work will be carried out in adding multidimensional pass-word generation

method to multi-level authentication technique.

This amalgamation of techniques can lead to another revolutionary concept of

authentication, that even surpasses the utility and robustness of the current authentication

schemes, the best of which is the 3D password at present. Of course, the fourth dimension

makes it totally unsurpassable.

20

8.CONCLUSION

The 4D password is a multifactor authentication scheme that combines the various

authentication schemes into a single 3D virtual environment. The virtual environment can contain

any existing authentication scheme or even any upcoming authentication scheme or even any

upcoming authentication schemes by adding it as a response to actions performed on an object.

Therefore the resulting password space becomes very large compared to any existing

authentication schemes. The design of the 3D virtual environment the selection of objects inside

the environment and the object's type reflect the resulted password space. It is the task of the

system administrator to design the environment and to select the appropriate object that reflects

the protected system requirements. Designing a simple and easy to use 3D virtual environment is

a factor that leads to a higher user acceptability of a 4D password system. The choice of what

authentication scheme will be part of user's 4D password reflects the user's preferences and

requirements.

21

9.REFERENCES

[1] Narang Winnie, Aman Grover “4-D Password: Strengthening the Authentication Scene”

International Journal of Scientific & Engineering Research, Volume 3, Issue 10, October-

2012

[2] A. Adams and M. A. Sasse, "Users are not the enemy: why users compromise computer

security mechanisms and how to take remedial measures," Communications of the ACM,

vol. 42, pp. 41-46, 2008.

[3] K. Gilhooly, "Biometrics: Getting Back to Business," in Computerworld, May 09, 2005.

[4] R. Dhamija and A. Perrig, "Deja Vu: A User Study Using Images for Authentication,"

in Proceedings of 9th USENIX Security Symposium, 2005.

[5] M. Kotadia, "Microsoft: Write down your passwords," in ZDNet Australia, May 23,

2005.

[6] A. Gilbert, "Phishing attacks take a new twist," in CNET News.com, May 04, 2005.

[7] A. Jain, L. Hong, and S. Pankanti, "Biometric identification," Communications of the

ACM, vol. 33, pp. 168-176, 2000.

[8] S. Wiedenbeck, J. Waters, J.-C. Birget, A. Brodskiy, and N. Memon, “Authentication using

graphical passwords: Basic results,” in Proc. Human-Comput. Interaction Int., Las Vegas, NV, Jul.

25–27, 1999.

[9] Fawaz A. Alsulaiman and Abdulmotaleb El Saddik,“Three-Dimensional Password for More

Secure Authentication,” IEEE, http://ieeexplore.ieee.org., Last Updated – 6 Feb 1998

[10] Thorpe, P.C. van Oorschot. Graphical Dictionaries and the Memorable Space of Graphical

Passwords,San Diego, J. Williams, “Narrow-Band Analyzer,” August 9-13, 1998

22