Keystroke Biometric Authentication on Smartphones Using Short Numeric Input Greg: Our project covers the topic of Keystroke Biometric Authentication, which will be refered to as KBA from now on. We cover the use of short numeric inputs as our user data, then analyze that data, then concluded whether or not KBA makes sense as a means of authentication. More on that in the upcoming slides. Keystroke Biometric Authentication on Smartphones Using Short Numeric Input
Team Member Greg: Here are our team members (read off names) Wei huang, wh57852n@pace.edu Juan Guzman, jg83695p@pace.edu Greg Goldberg, gg93863n@pace.edu Andrew Manuele, am65947n@pace.edu Hardik Patel, hp68381n@pace.edu Greg: Here are our team members (read off names) IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Our Customer Md Liakat Ali Current PhD student and research assistant at Pace University Masters in Computer Science and Electrical Engineering Contributed to several published papers on KBA Greg: Our customer is Ali. He is a current PhD student at Pace U. He contributed much research to several published papers on the subject of KBA. In addition to that has helped create the app and database which stores all keystoke biometric input data collected via smartphone, LG Nexus. (Don’t read the citations, just here for reference:) 1. John Monaco, Md Liakat Ali, Charles Tappert, “Spoofing Key-Press Latencies with a Generative Keystroke Dynamics Model”, 7th IEEE International Conference on Biometrics: Theory, Applications and Systems (BTAS 2015), September 8-11, 2015, Virginia, USA. 2. Md Liakat Ali, Charles C. Tappert, Meikang Qiu, and John V. Monaco, “Authentication and Identification Methods Used in Keystroke Biometric Systems”, 2015 IEEE 17th International Conference on High Performance Computing and Communications, August 24 – 26, 2015 New York, USA 3. Md Liakat Ali, Charles C. Tappert, and Meikang Qiu , “A Survey of Classification Methods Used in Keystroke Biometric Systems”, in Proceedings of Student-Faculty Research Day , May 1st, 2015, Pace University, New York, USA 4. Md Liakat Ali, John V. Monaco, and Charles C. Tappert, “Hidden Markov Models in Keystroke Dynamics” , in Proceedings of Student-Faculty Research Day ,May 1st, 2015, Pace University, New York, USA
1 - What is Keystroke Biometric Authentication? Content Covered 1 - What is Keystroke Biometric Authentication? 2 - KBA on Mobile Devices 3 - Data Survey 4 - Human Factors 5 - Input Methods 6 - Future Work 7 - Conclusion Greg: (Read off the agenda for our project): 1: what exactly is KBA? 2: Correlation between KBA and mobile devices 3: Our new Data Survey 4: Human Factors and how they play a role in KBA 5: How we can gather data and why we choose our method 6: Future work that needs to be done in order to get more accurate data 7: Our conclusion we reached after completing our research IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Summary of Keystroke Biometrics Authentication Keystroke = Every person has their own unique typing rhythm (like a fingerprint) Biometric = measure of time between press/release of a key Authentication = can be used to identify individuals and grant access to their smartphone or anything that needs to be secure and uses a keypad (physical or graphical) The ULTIMATE goal is to eliminate the need for alphanumeric passwords. Greg: To summarize KBA: it is a way to use each person’s unique typing rhythm as a means of authentication and allow access and use of that person’s smartphone. To further explain, it’s akin to a fingerprint, each person has a unique typing rhythm. Thus, a person’s typing rhythm can be used just as a password or key would. This rhythm is measured with Keystroke biometrics, which is measuring the speed at which a person presses and releases keys as well as the speed at which he/she moves to the next button. This biometric can be used to measure, analyze, and ultimately produce a unique squence. This squence is what can be used to identify the person and then grant that person access. The ulitmate goal of KBA is the eliminate the use of alphanumeric passwords
Keystroke Biometric Workflow Gather Client Objectives and Goals Research on Keystroke Biometrics Improved Data Survey Analyzed Data Survey Collected Data Keystroke from Mobile Phone Analyzed Data Keystroke Biometric Result and Conclusion Keystroke Biometric Wei Process of how we gathered data and ultimately analyzed the data. IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Using Keystroke Biometrics on Mobile Devices Wei IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Keystroke Authentication on Mobile Devices Identity User Biometric Capture Feature Pattern Comparison Verification Juan The process of verification: User must identify him/herself. Capture of authentication through the use of biometric input methods. Pattern are stored by the user’s features: keystrokes biometrics. Verification can be compared to the stored information and verified according to a specific set score. IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Human Factors Ethnic backgrounds Hand/Fingers dominance Gender Age Injuries Physical disabilities Mental disabilities Ambidexterity Juan: Ethnic background- is based on the different language and behavioral characteristics that can affect Keystroke pattern. Hand/Finger Dominance- is based on how individual input the information on a mobile device. Input Method will describe this topic further. Gender- Male have bigger hands than female while female have longer nails than male, making keystroke pattern to change from time to time. Manicure for female and fatigue for male and female after a long day at work. Age- is a factor because the development process can change one’s pattern during the adolescent years. Injuries- cuts, bruises, broken bones, etc are just some of the injuries than can affect a person’s input pattern. Physical disabilities- One with developmental physical problems as carpal tunnel, arthritis, poor manual dexterity, visual impairment Mental disabilities- can be based on chronic fatigue, seizures, sleep deficiency, chronic pain, etc. Ambidexterity- The consent use of right and left hand input method can cause false rejection rate to rise when authenticating. IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Comparison bet. Security Lock and Mobile Device Hardik IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Most Popular Input Methods Which Finger Do You Use Most on your Smartphone? Andrew Our research was focused on Two Thumb input as this was the most popular input method from our survey takers
Most Popular Security Code Methode
Prefered Hands
Input Methods for Mobile Devices a. 5 Main Input Methods: One Handed Method Dominant Non-Dominant Cradled Method Two Thumb Method b. Andrew: There are 5 main input methods on a smartphone Dominant One Handed Method - Holding the phone with dominant hand and using thumb for input Non-Dominant One Handed Method - Holding the phone with non-dominant hand and using thumb for input Dominant Cradle Method - Holding phone with dominant hand and touching screen with non-dominant thumb or finger Non-Dominant Cradle Method - Holding phone with non-dominant hand and touching screen with dominant thumb or finger Two Thumb Method - Holding the phone with both hands and inputting data with both thumbs. c. IT 691 Capstone Project 2016 By Team 11 Juan Guzman, Wei Huang, Greg Goldberg, Andrew Manuele, Hardik Patel
Keystroke Biometric Pattern Recognition Wei: 1. H.key designate a hold time for the named key (i.e., the time from when key was pressed to when it was released) 2. DD.key1.key2 designate a keydown-keydown time for the named digraph (i.e., the time from when key1 was pressed to when key2 was pressed). 3. UD.key1.key2 designate a keyup-keydown time for the named digraph (i.e., the time from when key1 was released to when key2 was pressed). The data show three-value information with Keystroke Dynamic in sequential pattern in cluster. Indeed, a digital keystroke fingerprint could be tied with a person. Keystroke dynamics can be use as access control that requiring a legitimate user to type a password, and by continually authenticating that user while they type on the keyboard.
Dominant vs. Nondominant Hand Hypothesis Ratio Input Hypothesis Future Work Dominant vs. Nondominant Hand Hypothesis Ratio Input Hypothesis Updating Input App Making App Available on Google Play Andrew: Below is an explanation of each bullet point for presentation purposes: “dominant vs. non-dominant hand hypothesis” - This team believes that there is a difference between the dwell time and hang time for each hand. Therefore each user would need to input 10 templates (5 input methods, see slide 12, * 2 hands) to have KBA authenticate effectively. “Ratio Input Hypothesis” - Another hypothesis that should be explored in the future is the validity of the ratio of between typing speed and typing pressure for dominant and nondominant hands. Dividing the average typing speed by the average pressure of a key press will result in a ratio that can be calculated with the dominant and nondominant hands. If the ratios are similar, on average, then the dominant hand vs. nondominant hand hypothesis is irrelevant. “Updating Input App” - Currently there are 2 apps on the smartphone, text and numeric input. Combine them into 1 app. The “text” portion will be a survey for users to take (name, hand dominance, age, etc). The numeric portion will be the normal phone number input. This adds more data per user, and is more in line with real life use of a phone “Making App Available on Google Play” - If others around the world can download the app, and results are sent to a server you can create a massive database with growing user inputs from around the world.
Conclusion KBA uses finger pressure and typing speed to identify users Unique to each individual Pros: More secure than passwords ease of use Cons: Human Factors can inhibit use Much more research is needed Based on our survey: Two Thumb Method is main input Majority of users have an IPhone Use the easiest method of security (4 digit PIN) therefore would be more likely to use KBA for ease of use Future Work Enhance App Hand Dominance a factor?