Graphical Password Authentication With Data Hiding

Project Overview

This project replaces the usual username and password login with three checks in a row: your credentials, a verification image, and a four-digit PIN picked from images instead of typed. It was built as a final year project at Anand Institute of Higher Technology, in a team of two. Once logged in, users can upload files that are encrypted with AES before they are stored. Other users can request a file, and they can only open it after the owner approves. The work was also written up and published as a research paper.

Problem Statement

Text passwords are easy to guess, reuse, phish, or watch over someone's shoulder, and most file sharing tools protect files with little more than HTTPS. Once a login is broken, everything behind it is exposed. The goal was a login that is harder to break but still easy for a person to remember, combined with file storage that stays protected even if someone gets into the database.

Solution Approach

Login runs in three stages. First, the user signs in with email and password. Second, they upload their verification image, and the system compares it with the one registered. Third, they enter a four-digit PIN by choosing images instead of typing numbers. Each stage only opens if the previous one passed. After login, every uploaded file is encrypted with AES before it is stored. To share a file, another user sends a request, and the owner has to approve it. Only then can the file be decrypted and opened.

Architecture Overview

A Flask application with a single SQLite database, split into authentication, image processing, encryption, and file sharing logic.

• Registration happens in two steps: profile and verification image first, then the image-based PIN.
• Login runs the three checks in order, and each stage redirects back to login if the earlier one is missing.
• The user's email is embedded in the green channel of the verification image using a one-level Haar DWT, then saved as a lossless PNG.
• Uploads are encrypted with PyCryptodome (AES-EAX), and the ciphertext, key, nonce, and tag are stored in SQLite.
• View and download routes check ownership or an approved request, then decrypt and verify the authentication tag before sending anything.
• A viewer page previews decrypted text and image files in the browser, and other files download directly.

Tech Stack

Key Features

• Three-stage login covering credentials, a verification image, and an image-based PIN.
• Verification image that carries the user's email hidden inside it with DWT steganography.
• Image matching with OpenCV colour histograms and a 0.9 similarity threshold.
• PIN entry from a grid of images instead of typed numbers.
• Registration with name, email, date of birth, phone, address, and gender.
• Passwords stored as SHA-256 hashes, never as plain text.
• AES-128 encryption for every uploaded file, with a unique key per file.
• Uploads for documents, images, and zip folders.
• File requests that the owner must approve before anyone else can open the file.
• Integrity check on every decryption, so a tampered file is rejected.
• In-browser preview for decrypted text and image files, and direct download for the rest.
• User dashboard for uploads, requests, and account details.

Lessons Learned