A Shoulder-Surfing Resistant Image-Based Authentication Scheme with a Brain-Computer Interface

With the increasing availability of consumer brain-computer interfaces, new methods of authentication can be considered. In this paper, we present a shoulder surfing resistant means of entering a graphical password by measuring brain activity. The password is a subset of images displayed repeatedly by rapid serial visual presentation. The occurrence of a password image entails an event-related potential in the electroencephalogram, the P300 response. The P300 response is used to classify whether an image belongs to the password subset or not. We compare individual classifiers, trained with samples of a specific user, to general P300 classifiers, trained over all subjects. We evaluate the permanence of the classification results in three subsequent experiment sessions. The classification score significantly increases from the first to the third session. Comparing the use of natural photos or simple objects as stimuli shows no significant difference. In total, our authentication scheme achieves an equal error rate of about 10%. In the future, with increasing accuracy and proliferation, brain-computer interfaces could find practical application in alternative authentication methods.