Claims:We Claim:
1. Increase in password space
2. Reduce the burden on human brain to memorize difficult password
3. The system works on mobile and web based terminals
4. Difficult to carry out shoulder surfing assault.
5. The probability of breaking into the system is very less
6. The system works based on the information calculated from a small portion of the image.
7. For every user the password pattern will vary, as compared to the text based password.
8. Difficult to describe the password or share it with other users.
9. Every stage the user gets to know whether a correct label is selected or a wrong one, unlike the text based password which notifies the user only after the entire password has been punched in. , Description:Preamble to the description
The following specification describes working of the invention theoretically
Background
Field of the invention
[001] This method relates to the field of Human Computer Interaction (HCI), in the area of Graphical authentication, this system will help memorize the graphical passwords even better across multiple online accounts, reducing the burden of memorizing the password by the client, and also reducing the shoulder surfing assault.

Description of the related art
[002] with the high rise in the use of internet it is obvious that most users right from the 1st standard to the pension receivers have digital accounts. To protect these accounts users make use of text based passwords.

[003] on an average each user usually has more than one account; these accounts are protected using text based password. If the same password is used across all the accounts, then a comprise on one single account can land the user in a difficult situation.

[004] Most of the time online sites provides rules and regulations so that a strong password can be generated, usually, the user bypasses most of the instructions provided, which if followed will help to create a strong password. The main reason to avoid all these rules is, as it becomes taxing to memorize difficult password.

[005] The rules usually provided to create an online account have the following requirement, it must be at least 8 characters long, it must contain digits, letters symbols and at least one character must be in uppercase. To create a strong password based on all this conditions becomes very difficult and tends to create a very weak and vulnerable passwords, and at times word from the English dictionary on which a simple brute force attack can be easily performed.

Objects of Invention

[006] It is an object of the present invention to provide a user friendly system and convenient method that provides a very easy authentication system with a very minimal pressure on the human brain.
[007] It is an another object of the present invention to provide a platform that enables the clients to be easily verified by following a different path each time they log into the system

SUMMARY
[008] According to an aspect of the present disclosure, there is provided a method for user authentication generally known as the text based authentication. This method includes receiving a password from the user which require to be a minimum of eight characters extending up to twenty-five printable characters, from the keyboard , based on the password provided by the user , the system will automatically suggest some unique password which are generated based on the heuristics embedded in the system and the artificial Intelligence engine (AI) . The system further provides an option for the user either to proceed with the system generated password or the password provided by the user. The method further does a one way encryption, generating a hash on the password provided by the user and stores it in the database. The method further during the verification process expects the user to provide the correct user name along with the password provided during the registration phase, the system pulls up this information and recalculates the hash on the password provided by the user, if the hash matches with the hash stored in the database with respect to the respective user, then the user will be authenticated else the system will reject the user.
[009] According to another aspect of the present disclosure there is provided a system called as the graphical authentication system. The system includes use of a single or more images for authentication of the user. The main aim of this system is to reduce the burden on human brain on memorizing difficult passwords; the system includes a few clicks on the image which varies from three to five. The system allows the user to choose image of their interest. The Image is discretized into fixed cells of rows and columns further the user will click in the cell, if the click point is within the tolerance area from the center of the cell then then the click point will be associated with the first grid, if not within the tolerance area, then the click point will be associated with the other grid. The system during the verification process expects the user to reproduce the click on the same images within the tolerance area of the cell, if within the tolerance area of the cell , then the user will be authenticated else will be rejected.
[010] According to yet another aspect of the present disclosure there is provided a system also called as the graphical authentication system. The system works on similar lines 009 , the image is discretized in to cells of Rows and columns, with a numbering system for rows and columns, the cell selected by the user will be the intersection of the row and the column, which be predefined alphanumeric characters. The sole aim of using image in this system is to help to user to memorize the click point immediately, the image acts as a trigger for the human mind in the system .A hash value of these alphanumeric characters will be saved in the database. During the verification process the user has to click on the same cell, as done during the registration phase which will reproduce the same alphanumeric characters. The system will pull these alphanumeric characters and regenerate a hash on , to compare it with the hash value stored in the database, if a match occurs then the user will be authenticated else will be denied access to the system.
Brief Description of the Drawings
[011] Fig 1 illustrates the Registration procedure in the form of a flow chart
[012] Fig 2 illustrates the authentication process in the form of a flow chart
[013] Fig 3 illustrates the discretized image in the form of grid with circular tolerance in each of the cell
[014] Fig 4 illustrates the placement of the second grid on the image which handles the click point outside the circular tolerance.
[015] Fig 4 illustrates the Two row horizontal and vertical labels
Detailed description of the Embodiments
[016] The graphical authentication system provides the user with different images from different domains, the user has to create a story line based on the images selected , in such a way that they can remember the images every time they log on to the system .
[017] The first module for this system is Discretization of the Image, This module divide the image into squares, the grid size of the image is 7*11 . The lesser the size more the password space, but however overly populated divisions will increase the user difficulty in operating, especially on small hand-held devices. The division on both horizontal and vertical direction is set to 60 Pixels, the best suited size for selection of specific objects on small hand held touch devices. The system further considers only a certain portion of the cell, when touched by the user, this portion is in the form of a circle within each cell FIG 3 which is predefined based on the center of the cell.
[018] Incase if the user selects the portion outside the circle, then a second grid FIG 4 will take care of this selection point , the second grid which is overlaid on the first grid has the same dimension of 60 pixel per square.
[019] once the user selects a particular point on the image, the information stored in the database will be a combination of data points from the circular area, along with the grid number and the image id. The system uses the midpoint circle algorithm to retrieve information from the circular area. The midpoint circle algorithm is executed for every circumference of the circle as it moves towards the center. Every single bit on the circumference of the circle represents some information from the image.
[020] Intensity of each pixel is calculated and denoted in gray scale, the gray scale value is converted into binary combined with grid and Image number is stored in the database by performing a one way encryption on it .during the login phase initially the user has to login with username and a password, in-case the password is correct the user will get to see the first correct Image , on the image displayed to the user each circular area on the image will represent pixel values in binary , which include both the areas from both the grids. Now the user has to watch the image carefully and try to recollect which portion of the image was selected by the user during the Registration.
[021] FIG 5 shows the two row values in the horizontal and the vertical direction , based on the selection portion from the image the user has to key in the correct values that correspond the portion selected during the registration . The pair of values selected from the horizontal and the vertical act as the reference point to the exact portion selected by the user. The values that appear on the two row horizontal and the vertical bar keeps on continuously changing during every login as a result of this change a attacker trying to spy on the system will never get to know what keywords are entered in the system as the password.
[022] the values used in the two row horizontal and the vertical bar are a combination of uppercase alphabets, lower case alphabets ,and numbers from zero to nine, the combination of only alphanumeric characters will yield 1296 combinations, when upper case alphabets are included the combination of the alphabets will reach up to 3844. With the inclusion of only letters will give 676 combinations. Assuming the max combinations i.e. 3844 per image, when the same process is repeated five times the combinations will be (3844*5=19,220)
[023] The probability of trying to break this system is 8.415e-12 which is very less almost close to negligible.
[024] The system provides the user with three attempts in total to get access to the system, after which the system will be blocked for a period of 24 hours.
[025] FIG 1 illustrates the working of the proposed embodiment in the form of a flow chart At step 200 the user also known as the client starts with the process by providing with a unique username at step 201 the user will create a text based password, this password must be of minimum eight characters, with at least one character in uppercase, one digit and one special symbol, once this criteria is satisfied , a text based password will be created for the user, At step 202 the user will be provided with images across various domains , the user has to select an image of their liking, once image is selected , At step 203 the module mentioned at 017 and 018 is executed, At step 204 user selects a click point on the discretized image within the predefined areas as mentioned at module 019 followed by step 205 , 206 and 207 as mentioned in module 020
[026] FIG 2 illustrates the working of the proposed embodiment in the form of a flow chart At step 208 the user has to re login into the system with the stored username and the password after a success at this step, the user will move to step 209, at this step the user will be provided the first registered image that was chosen during the registration, the user has to just watch the image carefully and try to recollect the area that was chosen during the registration, as the password has to be chosen from the horizontal and vertical two row bar mention in module 021, the first row and the first column form the vertical and horizontal vertical bar that represent the intersection for grid 1, the second row and the second column form the vertical and horizontal that represent the intersection of grid 2. At step 211 the selection of the proper intersection will take the user to next phase of the verification process. In case it is a wrong select of the labels then the same image will remain on the screen for a total of three wrong attempts. If the selection is proper then the same iteration will run for five times making the system complex.
We Claim:
1. Increase in password space
2. Reduce the burden on human brain to memorize difficult password
3. The system works on mobile and web based terminals
4. Difficult to carry out shoulder surfing assault.
5. The probability of breaking into the system is very less
6. The system works based on the information calculated from a small portion of the image.
7. For every user the password pattern will vary, as compared to the text based password.
8. Difficult to describe the password or share it with other users.
9. Every stage the user gets to know whether a correct label is selected or a wrong one, unlike the text based password which notifies the user only after the entire password has been punched in.

TITLE: A NOVEL GRAPHICAL AUTHENTICATION METHOD TO MITIGATE SHOULDER SURFING ASSAULT

ABSTRACT
A novel graphical authentication method based on recall and recognition in the area of Human- Computer- Interaction (HCI), which is based on Data mining (DM) and Image processing (IP) techniques, provides the user with a different set of unique and dynamic password every time the user is authenticated by the system, in an interactive environment, also the system does not burden the human brain in memorizing difficult passwords across various online accounts, the created password cannot be verbally described nor written down on a piece of paper . The system can be effectively integrated on the latest touch screen devices as well on existing web based terminals. The (HCI) based system further increases the password space in comparison to any traditional graphical authentication methods and also mitigates the risk of shoulder surfing attack that could be carried out either physically or automated.