Improving Accuracy, Applicability and Usability of Keystroke Biometrics on Mobile Touchscreen Devices

Abstract

Authentication methods can be improved by considering implicit, individual behavioural cues. In particular, verifying users based on typing behaviour has been widely studied with physical keyboards. On mobile touchscreens, the same concepts have been applied with little adaptations so far. This paper presents the first reported study on mobile keystroke biometrics which compares touch-specific features between three different hand postures and evaluation schemes. Based on 20.160 password entries from a study with 28 participants over two weeks, we show that including spatial touch features reduces implicit authentication equal error rates (EER) by 26.4 -36.8% relative to the previously used temporal features. We also show that authentication works better for some hand postures than others. To improve applicability and usability, we further quantify the influence of common evaluation assumptions: known attacker data, training and testing on data from a single typing session, and fixed hand postures. We show that these practices can lead to overly optimistic evaluations. In consequence, we describe evaluation recommendations, a probabilistic framework to handle unknown hand postures, and ideas for further improvements.

A survey on behavioral biometric authentication on smartphones

“…Most of the evaluation methods in the literature are based on verification mode such as in [29,8,24], some other little evaluation methods have been used based on identification mode such as in [30]. Table 2 compares different proposed active authentication methods based on keystroke dynamics.…”

“…Table 2 compares different proposed active authentication methods based on keystroke dynamics. Buschek et al [8] evaluated their proposed authentication mechanism on a private dataset with 20160 samples. They used different models to make verification.…”

“…Trojahn et al [23] also asked users to enter a specified sentence with 11 characters ten times (two words with one space in between). Buschek et al [8] invited participants to spend two sessions, with a gap of at least one week. Each session comprised three main tasks where the participants typed 6 different passwords in random order, 20 times each.…”

Understanding Keystroke Dynamics for Smartphone Users Authentication and Keystroke Dynamics on Smartphones Built-In Motion Sensors

“…Experiments using characters as well as PIN have been conducted. Starting with EER 6.9% of the study using 6 characters [9], experiment using 6 to 8 characters showed EER of 21.02% [15], using 10 characters showed EER of 0.806% [16], and using 34 characters showed EER of 9.3% [17], respectively. Later, there was a new type of study that extracts pressure and time interval from image instead of keys [6].…”

Multi-Factor Authentication: A Survey

“…This approach could be easily combined with any text-input authentication methods as a typing pattern is unique for each person [119][120][121]. In case the MFA system is specifically developed for predefined gesture analysis [122], the user is required to replicate a previously learned movement while holding or wearing the sensing device [123][124][125].…”