Wireless networks are becoming more and more popular. In current wireless network environments, mobile users can use multiple wireless network interfaces built in their mobile devices to roam around the mobile networks. They can scan the wireless spectrums and utilize the network resources extremely, and they can roam into nearby wireless networks due to the mobility capabilities of the powerful mobile devices. Before connecting to an access point, an authentication process is necessary. There are many interactive wireless authentication protocols which have been proposed in the literature. Under the wireless networks, handover is an important property for a mobile user to change her/his position. However, the existing interactive wireless authentication protocols may cause unstable connection. This is because that a mobile user may perform failed authentications with some nearby invalid access points and thus she/he cannot finish handover in time. Hence, we would like to design a mechanism for a mobile user to determine the validity of access points before the interactive authentication, and the mobile user can choose a valid one when making handover. In our proposed scheme, the mobile user can just scan and receive authentication messages from access points without interactions with them while she/he can determine which one of them is valid. We call this cognitive authentication. Besides, we also propose cooperative defense which allows mobile users to exchange their received authentication messages for detecting illegal access points. Finally, we provide security proofs for our proposed scheme.

This thesis contributes to the study of the usability and security of visuo-cognitive authentication techniques, particularly those relying on recognition of abstract images, an area little researched. Many usability and security problems with linguistic passwords (including traditional text-based passwords) have been known for decades. Research into visually-based techniques intends to overcome these by using the extensive human capacity for recognising images, and add to the range of commercially viable authentication solutions. The research employs a mixed methodology to develop several contributions to the field. A novel taxonomy of visuo-cognitive authentication techniques is presented. This is based on analysis and synthesis of existing partial taxonomies, combined with new and extensive analysis of features of existing visuo-cognitive and other techniques. The taxonomy advances consistent terminology, and coherent and productive classification (cognometric, locimetric, graphimetric and manipulometric, based respectively on recognition of, location in, drawing of and manipulation of images) and discussion of the domain. The taxonomy is extensible to other classes of cognitive authentication technique (audio-cognitive, spatio-cognitive, biometric and token-based, etc.). A revised assessment process of the usability and security of visuo-cognitive techniques is proposed (employing three major assessment categories – usability, memorability and security), based on analysis, synthesis and refinement of existing models. The revised process is then applied to the features identified in the novel taxonomy to prove the process‘s utility as a tool to clarify both the what and the why of usability and security issues. The process is also extensible to other classes of authentication technique. iii Cognitive psychology experimental methods are employed, producing new results which show with statistical significance that abstract images are harder to learn and recall than face or object images. Additionally, new experiments and a new application of the chi-squared statistic show that users‘ choices of abstract images are not necessarily random over a group, and thus, like other cognitive authentication techniques, can be attacked by probabilistic dictionaries. A new authentication prototype is designed and implemented, embodying the usability and security insights gained. Testing of this prototype shows good usability and user acceptance, although speed of use remains an issue. A new experiment shows that abstract image authentication techniques are vulnerable to phishing attacks. Further, the testing shows two new results: that abstract image visuo-cognitive techniques are usable on mobile phones; and that such phones are not, currently, necessarily a threat as part of observation attacks on visual passwords.