Unique Touchscreen Authentication Schemes

Question

I am working on a new software application that will have access to millions of patient medical records. I want this to be secure.

The initial thought process was to simply use a standard username and password scheme. The problem I see with this is that all of our users will simply use the same username/password combo they use on every other site. This seems like a big security risk.

This led me to start thinking about alternatives to username/password that meet the following criteria:

1. Quick to enter
2. Highly secure
3. Easy to remember
4. Unlikely to be shoulder-surfed.
5. Does not require any additional hardware (biometrics, cards, etc.)
6. Is relatively easy to implement

What I am currently working on is this:

The user must enter a 4-digit pin, followed by a pre-selected pattern of 4 icons.

Each time, they are presented with a grid of 36 icons that are randomly shuffled every time they see the grid. The icons are always the same, but they are in different locations.

The user has to choose their series of 4 icons, in order, from the grid.

With a 4-digit pin, that is 10,000 possible combinations. Added to a specific 4-icon series from a set of 36, we result in:

10,000 * (36 * 35 * 34 * 33) = 14,137,200,000 possible outcomes.

Does this seem like a reasonable solution for securing an application? What are the flaws in this plan?

Answer 1

Some thoughts:

1. I would look to the Blackberry 10 lock screen for inspiration. They are already doing something very similar; as far as I've used it, you set up a number (say "9") and a point on your background image (say the center of the padlock). At login you are given a randomized grid of numbers then, by grabbing anywhere on the screen, you drag the grid of numbers so that any "9" lines up with the center of the padlock. This nicely protects against shoulder-surfing - even if they can look at the finger smudges after - since they have no idea which number you lined up with which point in the image.

2. Since your question has strong User Experience / User Interface vibes, you may want to also post a similar question in the User Experience Stack Exchange.