Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The typical set of multi-factor categories is as follows:

  • Something you know (e.g. a password)
  • Something you have (e.g. a hardware token, or key file)
  • Something you are (e.g. a fingerprint or retina scan)

I'd argue that there is a fourth category - some behaviour you exhibit (or "something you do", to put it simply). This might be your gait (walking posture), your handwriting, or the way you type on a keyboard. It's often an extension of your physical form (e.g. musculature) that produces these behaviours, but they're also affected by psychology and often aren't as fixed as a physical attribute like a fingerprint.

I'm interested in how behavioural analysis can be used as a fourth authentication factor. I've worked on profiling keystroke dynamics before, using letter pair timings (e.g. average time between pressing 'q' and 'u') and various other metrics as a way to authenticate a person. My results were reasonably good; the profile I created authenticated me and denied access to several other people that attempted to gain access, though my testing wasn't particularly scientific or thorough.

However, I'm unsure as to how secure such metrics are on a larger scale. Are there any tried-and-tested mechanisms with known security margins and flaws? Are there any particular metrics that work better than others? Has there been any extensive research into this type of authentication factor? I'd certainly be interested to see any easily-digestable papers on the matter.

share|improve this question
    
It obviously has the same inherent flaws as biometrics. It's only suitable for local authentication and only works if you make sure an actual human is inputing the data on trusted hardware. –  CodesInChaos Dec 5 '12 at 11:43
2  
I'm familiar with this research: ise.bgu.ac.il/faculty/liorr/idth.pdf –  AviD Dec 5 '12 at 12:40
    
and just found this (havent read it yet) about Mouse Dynamics –  AviD Dec 5 '12 at 12:41
    
@AviD Will read through them later today. You might want to drop an answer on here with a few choice excerpts from the papers, so I can upvote you :) –  Polynomial Dec 5 '12 at 13:17
1  
And have you read this old paper by Avi Ruben? avirubin.com/fgcs.pdf - some good indicators –  Rory Alsop Dec 5 '12 at 15:58
show 1 more comment

5 Answers 5

up vote 3 down vote accepted

This has already been done by numerous vendors (click here), and patents have been on technologies similar to keystroke dynamics dating back as far as 1986 (click here or here).

Here is a paper which addresses using keystroke dynamics as biometric authentication, but I'm not sure how "digestible" it is for the lay person.

It would be hard to implement this across the board because, although a person's keystroke dynamics are often similar day-to-day you need to be able to account for significant variation. If a person is sick or tired they won't type the same as if they are angry.

Although I don't think this technology is ready for prime-time, I think it's great to discuss and investigate different types of biometric authentication and individual profiling to strengthen your security posture.

share|improve this answer
add comment

The second link AviD posted in comments diagrams its concept thus:

|User's machine|--|Events Acquisition|--|Feature Extraction|--|Classifier|--|Auth. DB|

Several things need to be considered in order to make this work:

  1. Tablets, phones, and other mobile devices will have VERY different user dynamics compared to keyboard/mouse. Any such system intended for use alongside credential authentication would need to account for this. (The linked paper even remarks in the closing section that the variety of configurations in mice alone would present difficulties.)

  2. The dynamics authentication channel would need to be protected in some way. It wouldn't necessarily be trivial to MITM this, but it's certainly not impossible.

  3. As others have posted, any such form of "cognitive footprint" authentication can be used only as a support for other forms of authentication. It cannot have equal weight to something one has or something one knows. Otherwise you run the risk of locking out a sick/emotional/tired user. (Usually fine for military applications, but for general public use it's a bad business decision.)

Bruce Schneier posted about this early this year, actually. There's some good discussion in the comments there, although nothing definitive.

TL;DR: Behavioural analysis cannot currently be given equal weight with other factors in MFA. Usage as a support factor is possible to about the same degree as biometrics.

share|improve this answer
add comment

It could be, but personally I haven't seen any data to support it. My gut feel is that it could be a useful additional factor, but I would not use it as a primary factor for authentication. As with most biometrics you need to understand how you define, set and compute the crossover threshold (where false positives and false negatives converge). This is a

share|improve this answer
1  
Could only ever be a supplementary authentication system; for example I often type in my password one-handed if I've got a mug of coffee or my phone in the other...! –  Savara Dec 5 '12 at 13:19
    
Did you mean to write more in this answer? It seems to end mid-sentence. –  Polynomial Dec 5 '12 at 16:20
add comment

Behavioral dynamics is about on par with signature analysis/forgery for security. Which is to say, a casual attacker isn't likely going to successfully impersonate you, but as you said, it's not something you are, it's something you do. It's habits rather than features.

Of course, behavioral tendencies are pretty instinctual, and difficult to change at-will, but nonetheless just about any behavior can be acquired given enough practice. So much the same way that written signature security is based on the assumption that no one will sufficiently practice forging your signature, the security of any other behavioral fingerprinting is based on the assumption that no one will train themselves to impersonate your behaviors.

So it's probably OK for casual security, but anything high-value where an actual concerted attack is likely; that's a bit more iffy. Some behaviors are probably much harder to impersonate than others, but in the end you're never going to have proof of the security of such a system, and your confidence in such a system should be correspondingly reserved.

share|improve this answer
add comment

It's certainly am interesting thought, however there's no research that I can find to support it. My instinct tells me that it would not be reliable, that changes in conditions, different keyboards, the subject him/herself would all add up to lots of false negatives and positives. Just think what intoxication, illness, or simple fatigue would do to your typing patterns! My fingerprint doesn't change when I'm short of sleep.

Also, how much would you have to type to establish a pattern?

share|improve this answer
1  
Being unable to log in while inebriated might be a marketable feature... ;) –  AJ Henderson Dec 5 '12 at 19:55
1  
Tell your CEO that, I double dog dare you. –  GdD Dec 6 '12 at 9:39
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.