Guildford: University of Surrey develops password innovation

The University of Surrey has developed an innovative ‘all-in-one’ password system that will allow users to use their face, eyes or fingerprints – alongside or instead of word-based systems – on their work or home computers.

The technology will allow users to generate much more complicated but still easy-to-remember passwords. This means that passwords will be significantly harder to crack, because hackers will not only have to break the password, they will also have to work out the format and composition of the password itself.

The new technology, named Pass∞ (pronounced PassInfinity), can be completely backward-compatible with existing computer systems, meaning it could be easily added to all systems immediately with little or without any changes to existing infrastructure.

Pass∞ has been invented by the Department of Computer Science’s Dr Shujun Li and his PhD student Nouf Aljaffan. It will not only make it easier for organisations and service providers to implement and maintain user authentication systems, but will also empower users with the ability to combine many different authentication actions for proving their identities.

It will do so while preserving the overall user experience with text-based passwords, biometrics-based user authentication systems (such as face, iris, fingerprint based systems) and multi-factor user authentication systems.

One of the many features Pass∞ can offer is user-friendly free combinations of multiple authentication actions such as entering normal passwords, styling some characters, selecting a picture, clicking some points on a picture, drawing something on a picture, showing your face in front of a webcam, and even adding the user’s current geo-locations.

Pass∞ is backward compatibility so that minimum or even no changes are needed to add new - and to reconfigure existing - user authentication modules, thus simplifying transitions from old authentication systems to new ones.

Li, a deputy director of Surrey Centre for Cyber Security (SCCS) and co-inventor of Pass∞, said: “This is definitely among the biggest ideas and the most exciting research work I have been working on at the University of Surrey for over five years. What makes the idea unique is the big contrast between the simplicity of the solution and how it solves many hard problems around passwords and user authentication in general. The new technology, which is in its final stages of development, will give both end users and organisations a simple and easy to use system that has great flexibility and agility to incorporate all known user authentication factors and many (if not all) known systems in a single framework and user interface.”

The inventors believe that Pass∞ has a great potential to increase both the security and the usability of passwords significantly as a much longer password can be generated from a shorter sequence of authentication actions which are easy to remember.