An Association-Based Graphical Password Design Resistant to Shoulder-Surfing Attack