The typical set of multi-factor categories is as follows:
- Something you know (e.g. a password)
- Something you have (e.g. a hardware token, or key file)
- Something you are (e.g. a fingerprint or retina scan)
I'd argue that there is a fourth category - some behaviour you exhibit (or "something you do", to put it simply). This might be your gait (walking posture), your handwriting, or the way you type on a keyboard. It's often an extension of your physical form (e.g. musculature) that produces these behaviours, but they're also affected by psychology and often aren't as fixed as a physical attribute like a fingerprint.
I'm interested in how behavioural analysis can be used as a fourth authentication factor. I've worked on profiling keystroke dynamics before, using letter pair timings (e.g. average time between pressing 'q' and 'u') and various other metrics as a way to authenticate a person. My results were reasonably good; the profile I created authenticated me and denied access to several other people that attempted to gain access, though my testing wasn't particularly scientific or thorough.
However, I'm unsure as to how secure such metrics are on a larger scale. Are there any tried-and-tested mechanisms with known security margins and flaws? Are there any particular metrics that work better than others? Has there been any extensive research into this type of authentication factor? I'd certainly be interested to see any easily-digestable papers on the matter.