Enhanced virtual password authentication scheme resistant to shoulder surfing

A username and password based login mechanism is commonly used for authenticating a user in online environments. It is a popular scheme because it helps to balance the usability and security traits of the system. However, online environments and pervasive computing may bring many risks through adversaries. Shoulder-surfing attack is one of the risks where attacker observes the authentication process and captures the password of victims. This paper proposes a hybrid-based authentication scheme termed "Enhanced Virtual Password Authentication (EVPA)". EVPA is designed to implement a virtual password mechanism to resist the shoulder surfing attacks. The virtual password mechanism requires a string part of password and a mathematical functional value to secure user passwords. The mathematical functional value keeps changing for each login session. This method uses a system generated random value and secret mathematical operation against the pre-selected secret number to obtain a mathematical functional value. Several experiments were conducted and the results demonstrate that systems are resilient to password attacks and usable for day to day purposes.