Game & Performance Authentication (GPA)

The security of any password based authentication scheme cannot protect you beyond WHAT your hacker can enter. Even when public key and encryption are implemented, your password can still be known through torture, key logger, social engineering, bedside eavesdropping and so on. In country like UK, you are already guilty by not devulging password under authority subpoena. No matter how strong your encryption scheme is, the problem of having a unique password ( long string )is that it is still not unique enough and that it can be written down on paper. When you are placed in a life threatening situation, this uniqueness can only be protected by how much you can withstand physical and emotional force of pain. Brute force isnt likely to be government's cup of tea if they want you to crack in 24 hours. The magic question of hacker and authority is still "WHAT is your password" ? Once WHAT is known, whatever related to WHAT is history. Game & Performance based authentication (GPA) solves this problem because password uniqueness is no longer on one dimension. Besides WHAT, under the GPA-scheme, hacker has to know HOW is your password WHEN is your password WHY is your password WHERE is your password

The best way to capture these 5 dimensions of information is through the implemention of a game. No 2 persons play a game the same way. Be it chess, DOOM, space invader, pac man, an individual's strategy (performance) is different from another. Even when I have a hacker watching over my shoulder when I play, there is no way this person can replicate my performance and strategy. Let say I am shooting a DOOM monster in the leg, I can shoot it at the knee (WHERE) 3 inches below the knee (WHERE) twice within 1 second but 2 seconds after 15:00 hour (WHEN) by unneccessarily re-loading my pistol between the 2 triggers (HOW) and still keep the monster alive because the monster should get up and scratch me ( WHY ). The hacker standing behind me is unlikely to emulate my strategy because I have spent hours perfecting my technique that I can do it blind folded. Performance is so unique that it is unlikely that the performer will be subject to torture because it takes time to heal from an injury in order to bring performance back to previous level of competency. If you know a particular sport and exercise that take years of hard work to build up your motion-sensor-captured SIGNATURE MOVE such as tennis, running, yoga, karate, golf, it will be even harder for a hacker to take up yoga classes and copy that move. This will be good news for sport celebrity, Guinness record and sport world record holder because performance is only one of a kind. If you run into problem with authority, you simply safeguard your password by blaming it on your being too old or too tired to perform. At least there is no law against being old. I dont mean that everyone must have a motion capture lab and race track installed in every house, this scheme can be implemented by playing a simple Java game of space invader. Imagine that your password compose of upper case and lower case letters and the 9 numeric keys. On the game screen, there are as many as 61 invaders awaiting to attack you. (26 uppercase +26 lower case+ 9 numeric keys=61). Each invader represents one of these keys, all you have to do to gain access is to shoot them in a special sequence while avoid getting hit. Since the invader attacks you randomly, brute force will become unattractive because it is made too slow. Let say the password is HhiJHOIjoiOIpU7, a hacker has to try shooting HhiJHOIjoiOIpU7 more than twice to find a performed sequence. There is no use to knowing the hit list sequence HhiJHOIjoiOIpU7 because the strategy is still the missing link. If this idea is widely implemented in retail check out, I am envisioning people armed with bluetooth-equipped gun or joystick, just like the old west cowboy and then play a little shooting game and complete their purchases.