Patent Application
20090150992
The invention relates to keystroke dynamics authentication. More specifically, the invention relates to data manipulations that offer improved performance for keystroke dynamics authentication systems.
Computer systems often contain valuable and/or sensitive information, control access to such information, or play an integral role in securing physical locations and assets. The security of information, assets and locations is only as good as the weakest link in the security chain, so it is important that computers reliably be able to distinguish authorized personnel from impostors. In the past, computer security has largely depended on secret passwords. Unfortunately, users often choose passwords that are easy to guess or that are simple enough to determine via exhaustive search or other means. When passwords of greater complexity are assigned, users may find them hard to remember, so may write them down, thus creating a new, different security vulnerability.
Various approaches have been tried to improve the security of computer systems. For example, in “have something, know something” schemes, a prospective user must know a password (or other secret code) and have (or prove possession of) a physical token such as a key or an identification card. Such schemes usually provide better authentication than passwords alone, but an authorized user can still permit an unauthorized user to use a system simply by giving the token and the secret code to the unauthorized user.
Other authentication methods rely on measurements of unique physical characteristics (“biometrics”) of users to identify authorized users. For example, fingerprints, voice patterns and retinal images have all been used with some success. However, these methods usually require special hardware to implement (e.g., fingerprint or retinal scanners; audio input facilities).
Techniques have been developed that permit computer users to be authenticated at machines without any special hardware. For example, U.S. Pat. No. 4,805,222 to Young et al. describes verifying the identity of an individual based on timing data collected while he types on a keyboard. Identification is accomplished by a simple statistical method that treats the collected data as an n-dimensional vector and computes the Euclidean distance between this vector and a reference vector. More sophisticated analyses have also been proposed. For example, U.S. Pat. No. 6,151,593 to Cho et al. suggests using a neural network to classify keystroke timing vectors as “like” or “unlike” a set of sample vectors, and U.S. Patent Application No. U.S. 2007/0245151 by Phoha et al. describes a specific neural-network-like method for creating keystroke dynamics templates from collected data, and using the templates to identify users.
The problem of comparing a biometric sample to a template or reference sample to determine whether the sample was produced by the same person who created the template or reference sample is a difficult one. Improved algorithms to produce biometric templates and to validate biometric samples may be useful in producing more accurate identifications with reduced false acceptance rates (“FAR”) and false reject rates (“FRR”).
Embodiments of the invention collect raw keystroke timing measurements as a user types on a computer keyboard. First-order derived data values are computed from the raw timing measurements. Then, second-order derived data values are computed from some of the first-order values. The first-order and second-order derived data values are used to produce a template that can be used to recognize a user's typing style. The derived data is also used during authentication, when a user submits a typing sample to be compared with a template to authenticate the user's claimed identity.
Embodiments of the invention are illustrated by way of example and not by way of limitation in the figures of the accompanying drawings in which like references indicate similar elements. It should be noted that references to “an” or “one” embodiment in this disclosure are not necessarily to the same embodiment, and such references mean “at least one.”
After (optional) extrinsic identification, the user selects a phrase (120). In many embodiments, the phrase is the user's (secret) password, but it is not necessary that the phrase be secret, or even that it be unique to the user. In some systems, a user may use two or more phrases during enrollment and verification. For example, the first phrase may be the user's login name or email address, and the second phrase may be his password.
An embodiment prompts the user to type the phrase (130), and collects timing data as the user types it (140). The user signals the end of the phrase by typing a key like “Enter,” “Return,” “Send” or “Tab,” or by pressing a button of a mouse or other user interface device. Next, derived data is computed from the raw timing data values (150). Based on the collected samples, if more samples are needed (160), the collection and computation process repeats. If an adequate number of samples have been collected (165), then a template is prepared from the collected timing data (170) and stored for use in subsequent authentication operations (180).
In some embodiments, a candidate need not make any assertion as to his identity. He may simply type a phrase, which the system compares to all enrolled users' phrases and keystroke dynamics templates. If the candidate's typed phrase matches one of these, he is granted access according to the matching template.
Vertical dashed lines 340 indicate when a key press or key release event occurs by pointing to a spot along “Time” axis 345. For example, the first depression of the “Shift” key 315 occurs at time 350. Subsequently, the ‘B’ key 355 is depressed at time 360 and then released at time 365. Characters of the phrase 300 are produced in the order that character-generating keys are depressed. Two or more keys may be depressed simultaneously (for example, both “Shift” key 315 and ‘4’ key 325 are depressed during the interval circled at 330. Character-generating keys are those that produce a character when they are depressed. Of the keys shown in this Figure, all except “Shift” key 315 are character-generating. The “Shift” key 315 is a modifier that may change the character produced when a character-generating key is depressed.
Sometimes a key release corresponding to a first key press may occur after the subsequent key press. This situation is depicted in
An embodiment of the invention collects information about the depression and release of keys typed by a user during enrollment or during authentication. This information typically comprises the items listed in Table 1:
In other words, each time a key is pressed or released, a record is produced identifying the key, the action and the time at which the action occurred. This is the only “real” or physical data collected in many embodiments. Special keyboards that can sense typing pressure, finger temperature, or the like, may produce more real data, but such keyboards are uncommon, and an embodiment gives up broader applicability if it relies on such enhanced data.
Times may be given as real (“wall-clock”) time (with the resolution and accuracy of a clock available to the system) or as a time relative to a known event such as the most recent system restart. Neither of these times is directly useful for analyzing keystroke dynamics of a user typing a phrase, so an embodiment of the invention computes a first set of derived data based on the collected raw timings.
Other derived measures could also be used by an embodiment. For example, the key-press-to-subsequent-key-press time 430, or key-release-to-subsequent-key-release time 440 also permit the events that occurred during the typing of the phrase to be represented in a useful way. Some embodiments may compute key press and release times relative to the key press event that starts the entry of the phrase, or the key press (or release) event that ends entry of the phrase.
The first set of derived values can be computed trivially by subtraction. Table 2 shows dwell values thus computed from the raw key-press and key-release times shown in Table 1:
Note that modifier dwell times are usually significantly longer than the dwell times of the keys they modify, and may not be as consistent due to variations in modifier key size, shape and location between keyboards. Some embodiments disregard modifier key-press and release events when computing derived values. These values (and ones like them) have been used successfully in the past to create biometric templates and to authenticate users. However, by further processing the first set of derived values to produce a second set of derived values, more keystroke dynamics information about the phrase entry can be exposed and used by an embodiment of the invention to improve a system's performance (e.g., to reduce the false-accept ratio, the false-reject ratio, or both).
One derived measurement that has proven to be particularly effective in improving system performance is the rate of change of key dwell during the entry of the phrase. This derived measurement is called the “dwell tendency.” It indicates whether the user is holding keys for longer or shorter periods as the phrase entry proceeds. Thus, a negative dwell tendency means that the user's keypresses are becoming shorter, while a positive dwell tendency means that the user's keypresses are becoming longer. These correspond roughly to faster and slower typing, respectively. Of course, a user's typing speed may vary continuously during the typing of a phrase as a result of key pairs (and longer sequences) that are easier or harder to type. Table 3 shows dwell tendencies corresponding to the dwell times shown in Table 2:
An analogy can help explain how an embodiment of the invention improves keystroke dynamics identifications. Consider a system that is to identify vehicles based on a series of Global Positioning System (“GPS”) fixes. Three different vehicles are to be distinguished: a bicycle, a container ship and an airplane. A raw GPS fix may provide only limited distinguishing power: any of the vehicles could be at many locations (to a certain degree of accuracy—it is appreciated that a bicycle is unlikely to be found in the middle of the ocean, or a container ship at an altitude much different from sea level). However, by computing a first set of derivative data from the raw GPS fixes, one obtains velocity-like measurements. Now, it may be possible to distinguish the airplane from the other vehicles, if it is traveling much faster than the speeds expected of the bicycle or container ship. At slower speeds, a second set of derived data may provide distinguishing clues. The “velocity tendency,” which is the change in velocity between two samples, may be more variable for the bicycle than for the other vehicles. This is because it is easier for the bicycle to speed up, slow down, turn and stop, and more likely that it will do so. Higher-order derived data may highlight other aspects of the vehicles' motion. In general, the derived data values are like a (mathematical) derivative with respect to time of the raw data: GPS fixes provide location; the first derived data provides velocity; the second derived data provides acceleration; and so on. Higher-order derivatives may also contain useful information about the motion of a vehicle, but eventually, the repeated derivation process will produce a result that is uniformly zero. Mathematically, if the movement of the vehicle over the measurement period can be described or adequately approximated by a polynomial function of degree n, then the (n+1)th derivative of the function (as well as all higher-order derivatives) will be zero. An automated vehicle-distinguishing system that is provided with (or calculates) higher-order derived data from raw location data is likely to be more successful at distinguishing vehicles than a system that only considers vehicle location.
Returning to the keystroke dynamics analysis performed by embodiments of the invention, it has been observed experimentally that useful information can be obtained from second- and third-order derivatives of the keystroke timing data. Template preparation and user authentication may not be significantly improved by the use of fourth- and higher-order derivatives.
Other derived values that have been considered are shown in the following table. They are presented roughly in order of decreasing identificative power. That is, dwell tendency improves authentication accuracy (by reducing the False Accept Rate and False Reject Rate) more than flight tendency, which in turn improves accuracy more than curvature flight. Embodiments of the invention use one or more of these second derived data sets in connection with the preparation of biometric templates and the use of those templates to perform user authentication.
Note that the various metrics listed in Table 4 were computed from a single large experimental dataset containing raw keystroke data collected as many different users typed the same phrase, with instructions to either type as they normally would, or to attempt to type as a different user does. The metrics were then ranked on their individual ability to distinguish legitimate users from imposters. A naive interpretation of the table would be that if a keystroke dynamics system was only going to use one measure to distinguish users, then the Dwell Total or Dwell Mean might provide the best performance. However, the rankings above do not take into account the number of data points available from a single phrase entry (this is the Data Points column; N is the number of characters in the phrase). In light of this, it is not surprising that Dwell Mean, which contains at least some information about every keystroke in the phrase, scores better than the plain Dwell time of any single keystroke. The contrived nature of the experimental samples seems to introduce significant biases. In a practical system, each user might have his own phrase, and impostor data would be more difficult to collect and analyze. Also, a practical system would base its enrollment and authentication decisions on several different metrics, not just one. Even though Dwell Tendency and Flight Tendency individually do not score highly, the set consisting of Dwell, Flight, Dwell Tendency and Flight Tendency has been found to outperform all other sets examined to date. Thus, a preferred embodiment computes Dwell and Flight values, derives Dwell Tendency and Flight Tendency from them, and provides those four values to the template-creation and candidate-authentication processes.
Note the inclusion in Table 4 of some rather esoteric metrics: parabola curve, radius and log-radius. These metrics treat three consecutive keystroke measurements (e.g., three consecutive dwells or flight times) as three, two-dimensional points, and examine a characteristic of a parabola or circle that passes through the points. The metrics provide a single number that encodes information about three keystrokes (for dwell-based measures) or four keystrokes (for flight-time-based measures). Further investigation of these (and similar) multi-keystroke metrics may expose useful information about a user's typing style and rhythm that can improve keystroke-dynamics identification.
The foregoing derived values expose various characteristics of a user's typing, in much the same way that derivatives of location with respect to time in the X, Y and Z directions expose various characteristics of a vehicle's motion. Some derivatives may be zero for some users, but may nevertheless highlight characteristic features of other users' typing. By calculating the derived values and providing them to the enrollment and authentication processes, an embodiment of the invention can highlight latent information in the raw data samples so that the system functions more effectively. Note that some of the derived values in Table 4 approximate a mathematical derivative of a function, defined as “rate of change of a dependent variable with respect to an independent variable;” while others are “derived” in the sense that they are calculated from predicate or precursor values. Dwell ratio and flight ratio are examples of this second sense.
A keystroke dynamics authentication system can use the derived values described above like any other data values concerning a user's typing style that can be collected or computed. For example, a statistical system may create an m-dimensional vector containing average key dwell tendency values computed when a user enrolls, and include this vector in the template. (m is an integer one less than the number of character-generating keystrokes in the phrase: for a seven-character phrase, there will be six key dwell tendency values.) During authentication, a similar m-dimensional vector of key dwell tendencies, computed based on a candidate's single entry of the phrase, may be examined to find its Euclidean distance from the corresponding vector in the template. The probability that the candidate is the same as the enrolling user is inversely proportional to the Euclidean distance. (It is probably more accurate to say that the probability is strongly negatively correlated with the distance.)
A neural-network-based keystroke dynamics authentication system may produce a template from raw data and derived values by a complex learning algorithm that obscures the precise physical meaning of any particular template element. However, such a template can be used to classify a set of raw and derived keystroke data collected and computed during an authentication attempt as either “like” or “unlike” the data that went into the template. If the neural network classifies a candidate's authentication sample as “like” the template, then it is probable that the candidate is the same as the user who enrolled.
An embodiment of the invention may be a machine-readable medium having stored thereon data and instructions to cause a programmable processor to perform operations as described above. In other embodiments, the operations might be performed by specific hardware components that contain hardwired logic. Those operations might alternatively be performed by any combination of programmed computer components and custom hardware components.
Instructions for a programmable processor may be stored in a form that is directly executable by the processor (“object” or “executable” form), or the instructions may be stored in a human-readable text form called “source code” that can be automatically processed by a development tool commonly known as a “compiler” to produce executable code. Instructions may also be specified as a difference or “delta” from a predetermined version of a basic source code. The delta (also called a “patch”) can be used to prepare instructions to implement an embodiment of the invention, starting with a commonly-available source code package that does not contain an embodiment.
In the preceding description, numerous details were set forth. It will be apparent, however, to one skilled in the art, that the present invention may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, to avoid obscuring the present invention.
Some portions of the detailed descriptions were presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.
It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the preceding discussion, it is appreciated that throughout the description, discussions utilizing terms such as “processing” or “computing” or “calculating” or “determining” or “displaying” or the like, refer to the action and processes of a computer system or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.
The present invention also relates to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, compact disc read-only memory (“CD-ROM”), and magnetic-optical disks, read-only memories (“ROMs”), random access memories (“RAMs”), eraseable, programmable read-only memories (“EPROMs”), electrically-eraseable read-only memories (“EEPROMs”), Flash memories, magnetic or optical cards, or any type of media suitable for storing electronic instructions.
The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from the description below. In addition, the present invention is not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the invention as described herein.
A machine-readable medium includes any mechanism for storing information in a form readable by a machine (e.g., a computer). For example, a machine-readable medium includes a machine readable storage medium (e.g., read only memory (“ROM”), random access memory (“RAM”), magnetic disk storage media, optical storage media, flash memory devices, etc.), and so on.
The applications of the present invention have been described largely by reference to specific examples and in terms of particular allocations of functionality to certain hardware and/or software components. However, those of skill in the art will recognize that improved keystroke dynamic authentication can also be achieved by software and hardware that distribute the functions of embodiments of this invention differently than herein described. Such variations and implementations are understood to be captured according to the following claims.
