Prof. Por Lip Yee, Professor at CSNET, Universiti Malaya.
Prof. Por Lip Yee was invited as a Keynote Speaker at the 6th International Conference on Big Data and Artificial Intelligence and Software Engineering (ICBASE 2025), where he delivered research on secure graphical authentication titled "Human-Centric Graphical Passwords: A Cognitive Approach to Shoulder-Surfing Protection". The keynote applies cognitive science principles to the design of authentication systems, producing a scheme that is both harder to compromise by observation and faster to use in practice.
Authentication Under Observation
One of the most underappreciated attack vectors in knowledge-based authentication is physical observation. While cryptographic attacks require technical sophistication and remote access, shoulder-surfing requires little more than proximity and attention. An attacker watching a user enter their credentials in a busy environment, or reviewing a recorded video, can extract sufficient information to reproduce a standard graphical password without any specialised tools. Environments such as healthcare workstations, financial kiosks, and shared educational terminals are particularly exposed to this risk.
Graphical Passwords and Human Cognition
Graphical password schemes exploit a well-documented asymmetry in human memory: people recognise and recall images far more reliably than arbitrary character strings of equivalent entropy. This advantage translates into fewer forgotten passwords, lower help-desk costs for organisations, and more consistent security behaviour from users. However, most implementations suffer from a predictability problem. Authentication gestures are visible and consistent across sessions, so an attacker who observes or records a single successful login can often reproduce it with high confidence.
The Proposed Approach
The scheme presented in this paper addresses predictability through two design principles operating in concert. First, randomized graphical challenges ensure that the visual presentation of each authentication session is distinct from all previous sessions, preventing an attacker from mapping any observed gesture sequence to a fixed credential. Second, a lightweight computation mechanism processes the user's input in a way that decouples the visible action from the underlying secret. A complete observation of a successful login session, including both what the user sees and what they do, does not yield the information needed to reproduce the authentication. Both mechanisms are designed with minimal computational overhead, making the scheme practical for deployment across a range of networked systems, including resource-constrained devices.
Security and Usability Evaluation
The scheme was evaluated against three shoulder-surfing threat models: direct visual observation, video-recorded replay, and correlation attacks derived from multiple observation sessions. Results confirmed strong resistance in all three scenarios. Usability testing with human subjects recorded an average improvement of approximately 18% in login speed relative to comparable benchmark graphical authentication systems, demonstrating that the cognitive design approach achieves enhanced security without penalising the user experience. The proposed scheme is positioned as a practical upgrade for secure access control in data-driven applications across healthcare, financial, and educational sectors.
The paper was presented at ICBASE 2025, the 6th International Conference on Big Data and Artificial Intelligence and Software Engineering.